{"id":"EUVD-2026-76157","revision":"8a5a1c26b6744eefa6bf84b8a783c07d","records":[{"revision":"8a5a1c26b6744eefa6bf84b8a783c07d","observedAt":"2026-11-07T15:24:29.921+00:00","statement":{"source":"euvd","id":"EUVD-2026-76157","aliases":["CVE-2026-89090"],"title":"An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response fra…","description":"An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response frame containing a header value type outside the valid range.\n\n\n\nTo remediate this issue, users should upgrade to release-2026-03-23 or later, and patch any forked or derivative code.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":8.2,"severity":null}],"references":["https://github.com/aws/aws-sdk-go-v2/security/advisories/GHSA-xmrv-pmrh-hhx2","https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23","https://aws.amazon.com/security/security-bulletins/2026-110-aws/"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-76157","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 11, 2026, 5:03:33 PM","dateUpdated":"Sep 24, 2026, 7:29:25 PM"},"relatedAdvisories":[{"id":"openSUSE-SU-2026:12107-1","title":"amazon-ecs-init-1.108.0-1.1 on GA media","vulnerabilityIds":["CVE-2026-84445","CVE-2026-89090"]},{"id":"RHSA-2026:91249","title":"Red Hat Security Advisory: Red Hat AI Base Images 3.5.5 (Neuron)","vulnerabilityIds":["CVE-2025-69418","CVE-2026-6653","CVE-2026-11979","CVE-2026-13346","CVE-2026-25679","CVE-2026-25680","CVE-2026-25681","CVE-2026-27136","CVE-2026-27137","CVE-2026-27138","CVE-2026-27139","CVE-2026-27141","CVE-2026-27142","CVE-2026-27145","CVE-2026-28390","CVE-2026-31790","CVE-2026-32280","CVE-2026-32281","CVE-2026-32282","CVE-2026-32288","CVE-2026-32289","CVE-2026-33811","CVE-2026-33814","CVE-2026-34182","CVE-2026-34183","CVE-2026-39820","CVE-2026-39822","CVE-2026-39823","CVE-2026-39825","CVE-2026-39826","CVE-2026-39836","CVE-2026-42499","CVE-2026-42502","CVE-2026-42504","CVE-2026-42505","CVE-2026-42506","CVE-2026-42507","CVE-2026-45445","CVE-2026-45447","CVE-2026-74860","CVE-2026-86138","CVE-2026-86140","CVE-2026-86142","CVE-2026-86143","CVE-2026-86144","CVE-2026-86145","CVE-2026-89090","CVE-2026-89161","CVE-2026-103111","CVE-2026-114406"]},{"id":"openSUSE-SU-2026:22145-1","title":"Security update for amazon-ecs-init","vulnerabilityIds":["CVE-2026-84445","CVE-2026-89090"]},{"id":"openSUSE-SU-2026:11803-1","title":"alloy-1.19.2-1.1 on GA media","vulnerabilityIds":["CVE-2026-2303","CVE-2026-37236","CVE-2026-41178","CVE-2026-45679","CVE-2026-45680","CVE-2026-45681","CVE-2026-45683","CVE-2026-45684","CVE-2026-46600","CVE-2026-48496","CVE-2026-56852","CVE-2026-56854","CVE-2026-71556","CVE-2026-71557","CVE-2026-75889","CVE-2026-75890","CVE-2026-81521","CVE-2026-89090"]},{"id":"SUSE-SU-2026:24265-1","title":"Security update for amazon-ecs-init","vulnerabilityIds":["CVE-2026-84445","CVE-2026-89090"]},{"id":"openSUSE-SU-2026:22032-1","title":"Security update for alloy","vulnerabilityIds":["CVE-2026-2303","CVE-2026-37236","CVE-2026-41178","CVE-2026-45679","CVE-2026-45680","CVE-2026-45681","CVE-2026-45683","CVE-2026-45684","CVE-2026-46600","CVE-2026-48496","CVE-2026-56852","CVE-2026-56854","CVE-2026-56855","CVE-2026-71556","CVE-2026-71557","CVE-2026-75889","CVE-2026-78662","CVE-2026-81521","CVE-2026-89090"]},{"id":"SUSE-SU-2026:24148-1","title":"Security update for alloy","vulnerabilityIds":["CVE-2026-2303","CVE-2026-37236","CVE-2026-41178","CVE-2026-45679","CVE-2026-45680","CVE-2026-45681","CVE-2026-45683","CVE-2026-45684","CVE-2026-46600","CVE-2026-48496","CVE-2026-56852","CVE-2026-56854","CVE-2026-56855","CVE-2026-71556","CVE-2026-71557","CVE-2026-75889","CVE-2026-78662","CVE-2026-81521","CVE-2026-89090"]},{"id":"openSUSE-SU-2026:11821-1","title":"kbfs-6.6.3-5.1 on GA media","vulnerabilityIds":["CVE-2026-89090"]},{"id":"openSUSE-SU-2026:22224-1","title":"Security update for rqlite","vulnerabilityIds":["CVE-2026-39821","CVE-2026-63209","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445","CVE-2026-89090"]},{"id":"RHSA-2026:91248","title":"Red Hat Security Advisory: Red Hat AI Base Images 3.4.6 (Neuron)","vulnerabilityIds":["CVE-2025-69418","CVE-2026-6653","CVE-2026-11979","CVE-2026-13346","CVE-2026-25679","CVE-2026-25680","CVE-2026-25681","CVE-2026-27136","CVE-2026-27137","CVE-2026-27138","CVE-2026-27139","CVE-2026-27141","CVE-2026-27142","CVE-2026-27145","CVE-2026-28390","CVE-2026-31790","CVE-2026-32280","CVE-2026-32281","CVE-2026-32282","CVE-2026-32288","CVE-2026-32289","CVE-2026-33811","CVE-2026-33814","CVE-2026-34182","CVE-2026-34183","CVE-2026-39820","CVE-2026-39822","CVE-2026-39823","CVE-2026-39825","CVE-2026-39826","CVE-2026-39836","CVE-2026-42499","CVE-2026-42502","CVE-2026-42504","CVE-2026-42505","CVE-2026-42506","CVE-2026-42507","CVE-2026-44172","CVE-2026-45445","CVE-2026-45447","CVE-2026-74860","CVE-2026-86138","CVE-2026-86140","CVE-2026-86142","CVE-2026-86143","CVE-2026-86144","CVE-2026-86145","CVE-2026-89090","CVE-2026-89161","CVE-2026-103111","CVE-2026-114406"]},{"id":"openSUSE-SU-2026:12186-1","title":"rqlite-10.6.1-1.1 on GA media","vulnerabilityIds":["CVE-2026-63209","CVE-2026-84304","CVE-2026-84445","CVE-2026-89090"]},{"id":"openSUSE-SU-2026:21925-1","title":"Security update for keybase-client","vulnerabilityIds":["CVE-2026-89090"]},{"id":"openSUSE-SU-2026:12208-1","title":"amazon-cloudwatch-agent-1.300073.0-3.1 on GA media","vulnerabilityIds":["CVE-2026-78669","CVE-2026-89090"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-76157","identifiers":["EUVD-2026-76157","CVE-2026-89090"]},"retained":false,"historicalAffected":[]}],"coverage":[]}