{"schema_version":"1.3.1","id":"GO-2026-5764","modified":"2026-07-07T16:52:19Z","published":"2026-07-07T16:52:19Z","aliases":["GHSA-xmrv-pmrh-hhx2"],"summary":"DoS due to Panic in AWS SDK for Go v2 SDK EventStream Decoder in github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream","details":"DoS due to Panic in AWS SDK for Go v2 SDK EventStream Decoder in github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream","affected":[{"package":{"name":"github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream","ecosystem":"Go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.7.8"}]}],"ecosystem_specific":{}},{"package":{"name":"github.com/aws/aws-sdk-go-v2/service/bedrockagentcore","ecosystem":"Go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.15.2"}]}],"ecosystem_specific":{}},{"package":{"name":"github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime","ecosystem":"Go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.51.8"}]}],"ecosystem_specific":{}},{"package":{"name":"github.com/aws/aws-sdk-go-v2/service/bedrockruntime","ecosystem":"Go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.50.4"}]}],"ecosystem_specific":{}},{"package":{"name":"github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs","ecosystem":"Go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.65.0"}]}],"ecosystem_specific":{}},{"package":{"name":"github.com/aws/aws-sdk-go-v2/service/iotsitewise","ecosystem":"Go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.52.19"}]}],"ecosystem_specific":{}},{"package":{"name":"github.com/aws/aws-sdk-go-v2/service/kinesis","ecosystem":"Go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.43.5"}]}],"ecosystem_specific":{}},{"package":{"name":"github.com/aws/aws-sdk-go-v2/service/lambda","ecosystem":"Go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.88.5"}]}],"ecosystem_specific":{}},{"package":{"name":"github.com/aws/aws-sdk-go-v2/service/lexruntimev2","ecosystem":"Go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.35.15"}]}],"ecosystem_specific":{}},{"package":{"name":"github.com/aws/aws-sdk-go-v2/service/s3","ecosystem":"Go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.97.3"}]}],"ecosystem_specific":{}},{"package":{"name":"github.com/aws/aws-sdk-go-v2/service/sagemakerruntime","ecosystem":"Go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.39.6"}]}],"ecosystem_specific":{}},{"package":{"name":"github.com/aws/aws-sdk-go-v2/service/transcribestreaming","ecosystem":"Go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.34.5"}]}],"ecosystem_specific":{}}],"references":[{"type":"ADVISORY","url":"https://github.com/aws/aws-sdk-go-v2/security/advisories/GHSA-xmrv-pmrh-hhx2"},{"type":"WEB","url":"https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23"}],"database_specific":{"url":"https://pkg.go.dev/vuln/GO-2026-5764","review_status":"REVIEWED"}}