| id: GO-2026-5764 |
| modules: |
| - module: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream |
| versions: |
| - fixed: 1.7.8 |
| vulnerable_at: 1.7.7 |
| - module: github.com/aws/aws-sdk-go-v2/service/bedrockagentcore |
| versions: |
| - fixed: 1.15.2 |
| vulnerable_at: 1.15.1 |
| - module: github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime |
| versions: |
| - fixed: 1.51.8 |
| vulnerable_at: 1.51.7 |
| - module: github.com/aws/aws-sdk-go-v2/service/bedrockruntime |
| versions: |
| - fixed: 1.50.4 |
| vulnerable_at: 1.50.3 |
| - module: github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs |
| versions: |
| - fixed: 1.65.0 |
| vulnerable_at: 1.64.2 |
| - module: github.com/aws/aws-sdk-go-v2/service/iotsitewise |
| versions: |
| - fixed: 1.52.19 |
| vulnerable_at: 1.52.18 |
| - module: github.com/aws/aws-sdk-go-v2/service/kinesis |
| versions: |
| - fixed: 1.43.5 |
| vulnerable_at: 1.43.4 |
| - module: github.com/aws/aws-sdk-go-v2/service/lambda |
| versions: |
| - fixed: 1.88.5 |
| vulnerable_at: 1.88.4 |
| - module: github.com/aws/aws-sdk-go-v2/service/lexruntimev2 |
| versions: |
| - fixed: 1.35.15 |
| vulnerable_at: 1.35.14 |
| - module: github.com/aws/aws-sdk-go-v2/service/s3 |
| versions: |
| - fixed: 1.97.3 |
| vulnerable_at: 1.97.2 |
| - module: github.com/aws/aws-sdk-go-v2/service/sagemakerruntime |
| versions: |
| - fixed: 1.39.6 |
| vulnerable_at: 1.39.5 |
| - module: github.com/aws/aws-sdk-go-v2/service/transcribestreaming |
| versions: |
| - fixed: 1.34.5 |
| vulnerable_at: 1.34.4 |
| summary: |- |
| DoS due to Panic in AWS SDK for Go v2 SDK EventStream Decoder in |
| github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream |
| ghsas: |
| - GHSA-xmrv-pmrh-hhx2 |
| references: |
| - advisory: https://github.com/aws/aws-sdk-go-v2/security/advisories/GHSA-xmrv-pmrh-hhx2 |
| - web: https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23 |
| notes: |
| - failed to auto-populate symbols: no fix commits found for all modules |
| source: |
| id: GHSA-xmrv-pmrh-hhx2 |
| created: 2026-07-07T00:21:57.091539854-04:00 |
| review_status: REVIEWED |
