What is 2026-110-AWS?

2026-110-AWS is a security advisory published by AWS Security Bulletins with High severity. CVE-2026-89090 - Denial of service in the event stream header decoder in AWS SDK for Go v2

Which CVE IDs does 2026-110-AWS cover?

2026-110-AWS covers the following CVE IDs: CVE-2026-89090. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

2026-110-AWSHigh

CVE-2026-89090 - Denial of service in the event stream header decoder in AWS SDK for Go v2

Vendor

AWS Security Bulletins

Published

September 11, 2026

Last Modified

—

🔗 CVE IDs covered (1)

CVE-2026-89090 →

📋 Description

Bulletin ID: 2026-110-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/11/2026 10:00 AM PDT Description: An issue exists in the the EventStream header decoder in AWS SDK for Go v2 in versions predating 2026-03-23. An actor can send a malformed EventStream response frame containing a crafted header value type byte outside the valid range, which can cause the host process to terminate. Impacted versions:
Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

🔗 References (1)

advisoryhttps://aws.amazon.com/security/security-bulletins/rss/2026-110-aws/