github.com/aws/Aws-sdk-go-v2/service/s3-v1.27.6: 1 vulnerabilities (highest severity is: 5.9)

<details><summary><img src='https://whitesource-resources.whitesourcesoftware.com/vulnerability_details.png' width=19 height=20> Vulnerable Library - github.com/aws/Aws-sdk-go-v2/service/s3-v1.27.6</summary>

AWS SDK for the Go programming language. 
Library home page: <a href="https://proxy.golang.org/github.com/aws/!aws-sdk-go-v2/service/s3/@⁠v/v1.27.6.zip">https://proxy.golang.org/github.com/aws/!aws-sdk-go-v2/service/s3/@⁠v/v1.27.6.zip</a>
Sample Path to Dependency File: /go.mod
Path to vulnerable library: /go.mod


</details>

## Vulnerabilities

| Vulnerability | Severity | <img src='https://whitesource-resources.whitesourcesoftware.com/cvss3.png' width=19 height=20> CVSS | Dependency | Type | Fixed in (github.com/aws/Aws-sdk-go-v2/service/s3-v1.27.6 version) | Remediation Possible** |
| ------------- | ------------- | ----- | ----- | ----- | ------------- | --- |
| [CVE-2026-89090](https://www.mend.io/vulnerability-database/CVE-2026-89090) | <img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> Medium | 5.9 | detected in multiple dependencies | Direct | github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream - v1.7.8,github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs - v1.65.0,github.com/aws/aws-sdk-go-v2/service/bedrockruntime - v1.50.4,github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime - v1.51.8,github.com/aws/aws-sdk-go-v2/service/iotsitewise - v1.52.19,github.com/aws/aws-sdk-go-v2/service/bedrockagentcore - v1.15.2,github.com/aws/aws-sdk-go-v2/service/lambda - v1.88.5,github.com/aws/aws-sdk-go-v2/service/kinesis - v1.43.5,github.com/aws/aws-sdk-go-v2/service/lexruntimev2 - v1.35.15,github.com/aws/aws-sdk-go-v2/service/s3 - v1.97.3,github.com/aws/aws-sdk-go-v2/service/sagemakerruntime - v1.39.6,github.com/aws/aws-sdk-go-v2/service/transcribestreaming - v1.34.5 | &#10060; |
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

## Details

<details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> CVE-2026-89090</summary>


### Vulnerable Libraries - github.com/aws/Aws-sdk-go-v2/service/s3-v1.27.6, github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream-v1.4.5



### github.com/aws/Aws-sdk-go-v2/service/s3-v1.27.6

AWS SDK for the Go programming language. 
Library home page: <a href="https://proxy.golang.org/github.com/aws/!aws-sdk-go-v2/service/s3/@⁠v/v1.27.6.zip">https://proxy.golang.org/github.com/aws/!aws-sdk-go-v2/service/s3/@⁠v/v1.27.6.zip</a>
Sample Path to Dependency File: /go.mod
Path to vulnerable library: /go.mod


Dependency Hierarchy:
 - :x: **github.com/aws/Aws-sdk-go-v2/service/s3-v1.27.6** (Vulnerable Library)


### github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream-v1.4.5

AWS SDK for the Go programming language. 
Library home page: <a href="https://proxy.golang.org/github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream/@⁠v/v1.4.5.zip">https://proxy.golang.org/github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream/@⁠v/v1.4.5.zip</a>
Sample Path to Dependency File: /go.mod
Path to vulnerable library: /go.mod


Dependency Hierarchy:
 - github.com/aws/Aws-sdk-go-v2/service/s3-v1.27.6 (Root Library)
 - :x: **github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream-v1.4.5** (Vulnerable Library)


Found in base branch: main






### Vulnerability Details
 
 
An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response frame containing a header value type outside the valid range.
To remediate this issue, users should upgrade to release-2026-03-23 or later, and patch any forked or derivative code.

Publish Date: 2026-09-11
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2026-89090>CVE-2026-89090</a>




### CVSS 3 Score Details (5.9)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: High
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: None
 - Integrity Impact: None
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://www.mend.io/vulnerability-database/CVE-2026-89090">https://www.mend.io/vulnerability-database/CVE-2026-89090</a>
Release Date: 2026-09-11
Fix Resolution: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream - v1.7.8,github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs - v1.65.0,github.com/aws/aws-sdk-go-v2/service/bedrockruntime - v1.50.4,github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime - v1.51.8,github.com/aws/aws-sdk-go-v2/service/iotsitewise - v1.52.19,github.com/aws/aws-sdk-go-v2/service/bedrockagentcore - v1.15.2,github.com/aws/aws-sdk-go-v2/service/lambda - v1.88.5,github.com/aws/aws-sdk-go-v2/service/kinesis - v1.43.5,github.com/aws/aws-sdk-go-v2/service/lexruntimev2 - v1.35.15,github.com/aws/aws-sdk-go-v2/service/s3 - v1.97.3,github.com/aws/aws-sdk-go-v2/service/sagemakerruntime - v1.39.6,github.com/aws/aws-sdk-go-v2/service/transcribestreaming - v1.34.5






Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
</details>

Navigation Menu

github.com/aws/Aws-sdk-go-v2/service/s3-v1.27.6: 1 vulnerabilities (highest severity is: 5.9) #1184

Vulnerabilities

Details

Vulnerable Libraries - github.com/aws/Aws-sdk-go-v2/service/s3-v1.27.6, github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream-v1.4.5