https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 08:01:37 +0000 https://vulnerability.circl.lu/vuln/ghsa-xmrv-pmrh-hhx2 <p><strong>Affected:</strong> Go: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream, Go: github.com/aws/aws-sdk-go-v2/service/bedrockagentcore, Go: github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime, Go: github.com/aws/aws-sdk-go-v2/service/bedrockruntime, Go: github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs, Go: github.com/aws/aws-sdk-go-v2/service/iotsitewise, Go: github.com/aws/aws-sdk-go-v2/service/kinesis, Go: github.com/aws/aws-sdk-go-v2/service/lambda, Go: github.com/aws/aws-sdk-go-v2/service/lexruntimev2, Go: github.com/aws/aws-sdk-go-v2/service/s3 and 2 more</p> <p>**CVSSv3.1 Rating**: [Medium] **CVSSv3.1 Score**: [5.9] **CVSSv3.1 Vector String**: [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H]</p> <p>## Summary and Impact An issue exists in the the EventStream header decoder in AWS SDK for Go v2 in versions predating [2026-03-23](https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23). An actor can send a malformed EventStream response frame containing a crafted header value type byte outside the valid range, which can cause the host process to terminate.</p> <p>Impacted versions: &lt; [2026-03-23](https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23)</p> <p>## Patches This issue has been addressed in versions [2026-03-23](https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23) and above. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.</p> <p>## Workarounds Not Applicable</p> <p>## References If you have any questions or comments about this advisory, we ask that you contact [AWS/Amazon] Security via our [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.</p> <p><strong>Affected:</strong> Go: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream, Go: github.com/aws/aws-sdk-go-v2/service/bedrockagentcore, Go: github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime, Go: github.com/aws/aws-sdk-go-v2/service/bedrockruntime, Go: github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs, Go: github.com/aws/aws-sdk-go-v2/service/iotsitewise, Go: github.com/aws/aws-sdk-go-v2/service/kinesis, Go: github.com/aws/aws-sdk-go-v2/service/lambda, Go: github.com/aws/aws-sdk-go-v2/service/lexruntimev2, Go: github.com/aws/aws-sdk-go-v2/service/s3 and 2 more</p> <p>**CVSSv3.1 Rating**: [Medium] **CVSSv3.1 Score**: [5.9] **CVSSv3.1 Vector String**: [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H]</p> <p>## Summary and Impact An issue exists in the the EventStream header decoder in AWS SDK for Go v2 in versions predating [2026-03-23](https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23). An actor can send a malformed EventStream response frame containing a crafted header value type byte outside the valid range, which can cause the host process to terminate.</p> <p>Impacted versions: &lt; [2026-03-23](https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23)</p> <p>## Patches This issue has been addressed in versions [2026-03-23](https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23) and above. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.</p> <p>## Workarounds Not Applicable</p> <p>## References If you have any questions or comments about this advisory, we ask that you contact [AWS/Amazon] Security via our [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.</p> https://vulnerability.circl.lu/vuln/ghsa-xmrv-pmrh-hhx2