Vulnpedia
← Search CVEs

CVE-2026-89090

HIGH 8.2

Published 2026-09-11 · Last modified 2026-09-24

An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response frame containing a header value type outside the valid range. To remediate this issue, users should upgrade to release-2026-03-23 or later, and patch any forked or derivative code.

ELEVATED IMPACT

Severe if exploited (CVSS 8.2), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

0.3%chance of exploitation in 30 days · 23rd percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

8.2CVSS 4.0 · HIGH

  • ConfidentialityNone
  • IntegrityNone
  • AvailabilityHigh

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ⚠Complexity: Needs a race window or specific setup
  • ⚠Requirements: Specific conditions must be present

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Aws

Products Aws Sdk For Go V2

Weakness (CWE)

  • CWE-248: Uncaught exception

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References and research data (JSON)

Packages and version ranges

Each advisory describes its own package and affected ranges. A boundary applies to that range; it is not a universal upgrade recommendation.

  • github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream Go

    pkg:golang/github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream

    SEMVER range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 1.7.8
    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-xmrv-pmrh-hhx2/GHSA-xmrv-pmrh-hhx2.json"
  }
}
    GitHub Advisory Database · GHSA-xmrv-pmrh-hhx2 · Updated 2026-09-12T04:10:37.759930105Z
  • github.com/aws/aws-sdk-go-v2/service/bedrockagentcore Go

    pkg:golang/github.com/aws/aws-sdk-go-v2/service/bedrockagentcore

    SEMVER range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 1.15.2
    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-xmrv-pmrh-hhx2/GHSA-xmrv-pmrh-hhx2.json"
  }
}
    GitHub Advisory Database · GHSA-xmrv-pmrh-hhx2 · Updated 2026-09-12T04:10:37.759930105Z
  • github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime Go

    pkg:golang/github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime

    SEMVER range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 1.51.8
    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-xmrv-pmrh-hhx2/GHSA-xmrv-pmrh-hhx2.json"
  }
}
    GitHub Advisory Database · GHSA-xmrv-pmrh-hhx2 · Updated 2026-09-12T04:10:37.759930105Z
  • github.com/aws/aws-sdk-go-v2/service/bedrockruntime Go

    pkg:golang/github.com/aws/aws-sdk-go-v2/service/bedrockruntime

    SEMVER range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 1.50.4
    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-xmrv-pmrh-hhx2/GHSA-xmrv-pmrh-hhx2.json"
  }
}
    GitHub Advisory Database · GHSA-xmrv-pmrh-hhx2 · Updated 2026-09-12T04:10:37.759930105Z
  • github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs Go

    pkg:golang/github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs

    SEMVER range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 1.65.0
    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-xmrv-pmrh-hhx2/GHSA-xmrv-pmrh-hhx2.json"
  }
}
    GitHub Advisory Database · GHSA-xmrv-pmrh-hhx2 · Updated 2026-09-12T04:10:37.759930105Z
  • github.com/aws/aws-sdk-go-v2/service/iotsitewise Go

    pkg:golang/github.com/aws/aws-sdk-go-v2/service/iotsitewise

    SEMVER range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 1.52.19
    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-xmrv-pmrh-hhx2/GHSA-xmrv-pmrh-hhx2.json"
  }
}
    GitHub Advisory Database · GHSA-xmrv-pmrh-hhx2 · Updated 2026-09-12T04:10:37.759930105Z
  • github.com/aws/aws-sdk-go-v2/service/kinesis Go

    pkg:golang/github.com/aws/aws-sdk-go-v2/service/kinesis

    SEMVER range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 1.43.5
    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-xmrv-pmrh-hhx2/GHSA-xmrv-pmrh-hhx2.json"
  }
}
    GitHub Advisory Database · GHSA-xmrv-pmrh-hhx2 · Updated 2026-09-12T04:10:37.759930105Z
  • github.com/aws/aws-sdk-go-v2/service/lambda Go

    pkg:golang/github.com/aws/aws-sdk-go-v2/service/lambda

    SEMVER range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 1.88.5
    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-xmrv-pmrh-hhx2/GHSA-xmrv-pmrh-hhx2.json"
  }
}
    GitHub Advisory Database · GHSA-xmrv-pmrh-hhx2 · Updated 2026-09-12T04:10:37.759930105Z
  • github.com/aws/aws-sdk-go-v2/service/lexruntimev2 Go

    pkg:golang/github.com/aws/aws-sdk-go-v2/service/lexruntimev2

    SEMVER range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 1.35.15
    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-xmrv-pmrh-hhx2/GHSA-xmrv-pmrh-hhx2.json"
  }
}
    GitHub Advisory Database · GHSA-xmrv-pmrh-hhx2 · Updated 2026-09-12T04:10:37.759930105Z
  • github.com/aws/aws-sdk-go-v2/service/s3 Go

    pkg:golang/github.com/aws/aws-sdk-go-v2/service/s3

    SEMVER range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 1.97.3
    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-xmrv-pmrh-hhx2/GHSA-xmrv-pmrh-hhx2.json"
  }
}
    GitHub Advisory Database · GHSA-xmrv-pmrh-hhx2 · Updated 2026-09-12T04:10:37.759930105Z
  • github.com/aws/aws-sdk-go-v2/service/sagemakerruntime Go

    pkg:golang/github.com/aws/aws-sdk-go-v2/service/sagemakerruntime

    SEMVER range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 1.39.6
    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-xmrv-pmrh-hhx2/GHSA-xmrv-pmrh-hhx2.json"
  }
}
    GitHub Advisory Database · GHSA-xmrv-pmrh-hhx2 · Updated 2026-09-12T04:10:37.759930105Z
  • github.com/aws/aws-sdk-go-v2/service/transcribestreaming Go

    pkg:golang/github.com/aws/aws-sdk-go-v2/service/transcribestreaming

    SEMVER range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 1.34.5
    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-xmrv-pmrh-hhx2/GHSA-xmrv-pmrh-hhx2.json"
  }
}
    GitHub Advisory Database · GHSA-xmrv-pmrh-hhx2 · Updated 2026-09-12T04:10:37.759930105Z
  • github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream Go

    pkg:golang/github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream

    SEMVER range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 1.7.8
    Additional upstream package constraints
    {
  "ecosystem": {},
  "database": {
    "source": "https://vuln.go.dev/ID/GO-2026-5764.json"
  }
}
    Go Vulnerability Database · GO-2026-5764 · Updated 2026-09-12T04:10:37.759930105Z
  • github.com/aws/aws-sdk-go-v2/service/bedrockagentcore Go

    pkg:golang/github.com/aws/aws-sdk-go-v2/service/bedrockagentcore

    SEMVER range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 1.15.2
    Additional upstream package constraints
    {
  "ecosystem": {},
  "database": {
    "source": "https://vuln.go.dev/ID/GO-2026-5764.json"
  }
}
    Go Vulnerability Database · GO-2026-5764 · Updated 2026-09-12T04:10:37.759930105Z
  • github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime Go

    pkg:golang/github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime

    SEMVER range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 1.51.8
    Additional upstream package constraints
    {
  "ecosystem": {},
  "database": {
    "source": "https://vuln.go.dev/ID/GO-2026-5764.json"
  }
}
    Go Vulnerability Database · GO-2026-5764 · Updated 2026-09-12T04:10:37.759930105Z
  • github.com/aws/aws-sdk-go-v2/service/bedrockruntime Go

    pkg:golang/github.com/aws/aws-sdk-go-v2/service/bedrockruntime

    SEMVER range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 1.50.4
    Additional upstream package constraints
    {
  "ecosystem": {},
  "database": {
    "source": "https://vuln.go.dev/ID/GO-2026-5764.json"
  }
}
    Go Vulnerability Database · GO-2026-5764 · Updated 2026-09-12T04:10:37.759930105Z
  • github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs Go

    pkg:golang/github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs

    SEMVER range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 1.65.0
    Additional upstream package constraints
    {
  "ecosystem": {},
  "database": {
    "source": "https://vuln.go.dev/ID/GO-2026-5764.json"
  }
}
    Go Vulnerability Database · GO-2026-5764 · Updated 2026-09-12T04:10:37.759930105Z
  • github.com/aws/aws-sdk-go-v2/service/iotsitewise Go

    pkg:golang/github.com/aws/aws-sdk-go-v2/service/iotsitewise

    SEMVER range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 1.52.19
    Additional upstream package constraints
    {
  "ecosystem": {},
  "database": {
    "source": "https://vuln.go.dev/ID/GO-2026-5764.json"
  }
}
    Go Vulnerability Database · GO-2026-5764 · Updated 2026-09-12T04:10:37.759930105Z
  • github.com/aws/aws-sdk-go-v2/service/kinesis Go

    pkg:golang/github.com/aws/aws-sdk-go-v2/service/kinesis

    SEMVER range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 1.43.5
    Additional upstream package constraints
    {
  "ecosystem": {},
  "database": {
    "source": "https://vuln.go.dev/ID/GO-2026-5764.json"
  }
}
    Go Vulnerability Database · GO-2026-5764 · Updated 2026-09-12T04:10:37.759930105Z
  • github.com/aws/aws-sdk-go-v2/service/lambda Go

    pkg:golang/github.com/aws/aws-sdk-go-v2/service/lambda

    SEMVER range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 1.88.5
    Additional upstream package constraints
    {
  "ecosystem": {},
  "database": {
    "source": "https://vuln.go.dev/ID/GO-2026-5764.json"
  }
}
    Go Vulnerability Database · GO-2026-5764 · Updated 2026-09-12T04:10:37.759930105Z
  • github.com/aws/aws-sdk-go-v2/service/lexruntimev2 Go

    pkg:golang/github.com/aws/aws-sdk-go-v2/service/lexruntimev2

    SEMVER range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 1.35.15
    Additional upstream package constraints
    {
  "ecosystem": {},
  "database": {
    "source": "https://vuln.go.dev/ID/GO-2026-5764.json"
  }
}
    Go Vulnerability Database · GO-2026-5764 · Updated 2026-09-12T04:10:37.759930105Z
  • github.com/aws/aws-sdk-go-v2/service/s3 Go

    pkg:golang/github.com/aws/aws-sdk-go-v2/service/s3

    SEMVER range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 1.97.3
    Additional upstream package constraints
    {
  "ecosystem": {},
  "database": {
    "source": "https://vuln.go.dev/ID/GO-2026-5764.json"
  }
}
    Go Vulnerability Database · GO-2026-5764 · Updated 2026-09-12T04:10:37.759930105Z
  • github.com/aws/aws-sdk-go-v2/service/sagemakerruntime Go

    pkg:golang/github.com/aws/aws-sdk-go-v2/service/sagemakerruntime

    SEMVER range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 1.39.6
    Additional upstream package constraints
    {
  "ecosystem": {},
  "database": {
    "source": "https://vuln.go.dev/ID/GO-2026-5764.json"
  }
}
    Go Vulnerability Database · GO-2026-5764 · Updated 2026-09-12T04:10:37.759930105Z
  • github.com/aws/aws-sdk-go-v2/service/transcribestreaming Go

    pkg:golang/github.com/aws/aws-sdk-go-v2/service/transcribestreaming

    SEMVER range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 1.34.5
    Additional upstream package constraints
    {
  "ecosystem": {},
  "database": {
    "source": "https://vuln.go.dev/ID/GO-2026-5764.json"
  }
}
    Go Vulnerability Database · GO-2026-5764 · Updated 2026-09-12T04:10:37.759930105Z

Vendor product assessments

Showing 32 of 405 vendor product statements; 373 omitted. Read the full vendor advisory.

  • albo/aws-load-balancer-rhel8-operator as a component of AWS Load Balancer Operator · known affected

    Vendor assessment for this product only.

    pkg:oci/aws-load-balancer-rhel8-operator?repository_url=registry.redhat.io/albo/aws-load-balancer-rhel8-operator

    • workaround: Upgrade affected AWS SDK for Go v2 modules to the fixed releases published after 2026-03-23. There is no documented workaround.
    • no fix planned: Out of support scope
    Red Hat · CVE-2026-89090 · Updated 2026-10-15T11:24:12+00:00
  • compliance/openshift-file-integrity-rhel8-operator as a component of File Integrity Operator · known affected

    Vendor assessment for this product only.

    pkg:oci/openshift-file-integrity-rhel8-operator?repository_url=registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator

    • workaround: Upgrade affected AWS SDK for Go v2 modules to the fixed releases published after 2026-03-23. There is no documented workaround.
    • none available: Fix deferred
    Red Hat · CVE-2026-89090 · Updated 2026-10-15T11:24:12+00:00
  • oadp/oadp-velero-rhel9 as a component of OpenShift API for Data Protection · known affected

    Vendor assessment for this product only.

    pkg:oci/oadp-velero-rhel9?repository_url=registry.redhat.io/oadp/oadp-velero-rhel9

    • workaround: Upgrade affected AWS SDK for Go v2 modules to the fixed releases published after 2026-03-23. There is no documented workaround.
    • none available: Fix deferred
    Red Hat · CVE-2026-89090 · Updated 2026-10-15T11:24:12+00:00
  • openshift-serverless-1/kn-serving-controller-rhel9 as a component of OpenShift Serverless · known affected

    Vendor assessment for this product only.

    pkg:oci/kn-serving-controller-rhel9?repository_url=registry.redhat.io/openshift-serverless-1/kn-serving-controller-rhel9

    • workaround: Upgrade affected AWS SDK for Go v2 modules to the fixed releases published after 2026-03-23. There is no documented workaround.
    • none available: Fix deferred
    Red Hat · CVE-2026-89090 · Updated 2026-10-15T11:24:12+00:00
  • advanced-cluster-security/rhacs-main-rhel8 as a component of Red Hat Advanced Cluster Security 4 · known affected

    Vendor assessment for this product only.

    pkg:oci/rhacs-main-rhel8?repository_url=registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8

    • workaround: Upgrade affected AWS SDK for Go v2 modules to the fixed releases published after 2026-03-23. There is no documented workaround.
    • none available: Fix deferred
    Red Hat · CVE-2026-89090 · Updated 2026-10-15T11:24:12+00:00
  • ceph.src as a component of Red Hat Ceph Storage 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/ceph?arch=src

    • workaround: Upgrade affected AWS SDK for Go v2 modules to the fixed releases published after 2026-03-23. There is no documented workaround.
    • no fix planned: Out of support scope
    Red Hat · CVE-2026-89090 · Updated 2026-10-15T11:24:12+00:00
  • flightctl.src as a component of Red Hat Edge Manager 1 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=src

    • workaround: Upgrade affected AWS SDK for Go v2 modules to the fixed releases published after 2026-03-23. There is no documented workaround.
    • none available: Fix deferred
    Red Hat · CVE-2026-89090 · Updated 2026-10-15T11:24:12+00:00
  • butane.src as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=src

    • workaround: Upgrade affected AWS SDK for Go v2 modules to the fixed releases published after 2026-03-23. There is no documented workaround.
    • none available: Fix deferred
    Red Hat · CVE-2026-89090 · Updated 2026-10-15T11:24:12+00:00
  • osbuild-composer as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/osbuild-composer

    • workaround: Upgrade affected AWS SDK for Go v2 modules to the fixed releases published after 2026-03-23. There is no documented workaround.
    • none available: Fix deferred
    Red Hat · CVE-2026-89090 · Updated 2026-10-15T11:24:12+00:00
  • rhoai/odh-ml-pipelines-api-server-v2-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-ml-pipelines-api-server-v2-rhel9?repository_url=registry.redhat.io/rhoai/odh-ml-pipelines-api-server-v2-rhel9

    • workaround: Upgrade affected AWS SDK for Go v2 modules to the fixed releases published after 2026-03-23. There is no documented workaround.
    • none available: Fix deferred
    Red Hat · CVE-2026-89090 · Updated 2026-10-15T11:24:12+00:00
  • rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9?repository_url=registry.redhat.io/rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9

    • workaround: Upgrade affected AWS SDK for Go v2 modules to the fixed releases published after 2026-03-23. There is no documented workaround.
    • none available: Fix deferred
    Red Hat · CVE-2026-89090 · Updated 2026-10-15T11:24:12+00:00
  • openshift4/ose-agent-installer-api-server-rhel9 as a component of Red Hat OpenShift Container Platform 4 · known affected

    Vendor assessment for this product only.

    pkg:oci/ose-agent-installer-api-server-rhel9?repository_url=registry.redhat.io/openshift4/ose-agent-installer-api-server-rhel9

    • workaround: Upgrade affected AWS SDK for Go v2 modules to the fixed releases published after 2026-03-23. There is no documented workaround.
    • none available: Fix deferred
    Red Hat · CVE-2026-89090 · Updated 2026-10-15T11:24:12+00:00
  • openshift4/ose-kube-state-metrics-rhel9 as a component of Red Hat OpenShift Container Platform 4 · known affected

    Vendor assessment for this product only.

    pkg:oci/ose-kube-state-metrics-rhel9?repository_url=registry.redhat.io/openshift4/ose-kube-state-metrics-rhel9

    • workaround: Upgrade affected AWS SDK for Go v2 modules to the fixed releases published after 2026-03-23. There is no documented workaround.
    • none available: Fix deferred
    Red Hat · CVE-2026-89090 · Updated 2026-10-15T11:24:12+00:00
  • ose-aws-ecr-image-credential-provider.src as a component of Red Hat OpenShift Container Platform 4 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/ose-aws-ecr-image-credential-provider?arch=src

    • workaround: Upgrade affected AWS SDK for Go v2 modules to the fixed releases published after 2026-03-23. There is no documented workaround.
    • none available: Fix deferred
    Red Hat · CVE-2026-89090 · Updated 2026-10-15T11:24:12+00:00
  • rhoso-operators/openstack-operator-bundle as a component of Red Hat OpenStack Platform 18.0 · known affected

    Vendor assessment for this product only.

    pkg:oci/openstack-operator-bundle?repository_url=registry.redhat.io/rhoso-operators/openstack-operator-bundle

    • workaround: Upgrade affected AWS SDK for Go v2 modules to the fixed releases published after 2026-03-23. There is no documented workaround.
    • none available: Fix deferred
    Red Hat · CVE-2026-89090 · Updated 2026-10-15T11:24:12+00:00
  • zero-trust-workload-identity-manager/zero-trust-workload-identity-manager-rhel9 as a component of Zero Trust Workload Identity Manager - Tech Preview · known affected

    Vendor assessment for this product only.

    pkg:oci/zero-trust-workload-identity-manager-rhel9?repository_url=registry.redhat.io/zero-trust-workload-identity-manager/zero-trust-workload-identity-manager-rhel9

    • workaround: Upgrade affected AWS SDK for Go v2 modules to the fixed releases published after 2026-03-23. There is no documented workaround.
    • no fix planned: Out of support scope
    Red Hat · CVE-2026-89090 · Updated 2026-10-15T11:24:12+00:00
  • cosign.src as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: component not present

    pkg:rpm/redhat/[email protected]?arch=src

    Red Hat · CVE-2026-89090 · Updated 2026-10-15T11:24:12+00:00
  • grafana12.4.src as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: component not present

    pkg:rpm/redhat/[email protected]?arch=src

    Red Hat · CVE-2026-89090 · Updated 2026-10-15T11:24:12+00:00
  • grafana13.1.src as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: component not present

    pkg:rpm/redhat/[email protected]?arch=src

    Red Hat · CVE-2026-89090 · Updated 2026-10-15T11:24:12+00:00
  • grype.src as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: component not present

    pkg:rpm/redhat/[email protected]?arch=src

    Red Hat · CVE-2026-89090 · Updated 2026-10-15T11:24:12+00:00
  • hugo.src as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: component not present

    pkg:rpm/redhat/[email protected]?arch=src

    Red Hat · CVE-2026-89090 · Updated 2026-10-15T11:24:12+00:00
  • kube-state-metrics.src as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: component not present

    pkg:rpm/redhat/[email protected]?arch=src

    Red Hat · CVE-2026-89090 · Updated 2026-10-15T11:24:12+00:00
  • loki3.6.src as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: component not present

    pkg:rpm/redhat/[email protected]?arch=src

    Red Hat · CVE-2026-89090 · Updated 2026-10-15T11:24:12+00:00
  • opentelemetry-collector-contrib.src as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: component not present

    pkg:rpm/redhat/[email protected]?arch=src

    Red Hat · CVE-2026-89090 · Updated 2026-10-15T11:24:12+00:00
  • opentelemetry-collector-k8s.src as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: component not present

    pkg:rpm/redhat/[email protected]?arch=src

    Red Hat · CVE-2026-89090 · Updated 2026-10-15T11:24:12+00:00
  • opentofu1.10.src as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: component not present

    pkg:rpm/redhat/[email protected]?arch=src

    Red Hat · CVE-2026-89090 · Updated 2026-10-15T11:24:12+00:00
  • opentofu1.12.src as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: component not present

    pkg:rpm/redhat/[email protected]?arch=src

    Red Hat · CVE-2026-89090 · Updated 2026-10-15T11:24:12+00:00
  • rekor.src as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: component not present

    pkg:rpm/redhat/[email protected]?arch=src

    Red Hat · CVE-2026-89090 · Updated 2026-10-15T11:24:12+00:00
  • spire1.14.src as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: component not present

    pkg:rpm/redhat/[email protected]?arch=src

    Red Hat · CVE-2026-89090 · Updated 2026-10-15T11:24:12+00:00
  • syft.src as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: component not present

    pkg:rpm/redhat/[email protected]?arch=src

    Red Hat · CVE-2026-89090 · Updated 2026-10-15T11:24:12+00:00
  • tempo2.10.src as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: component not present

    pkg:rpm/redhat/[email protected]?arch=src

    Red Hat · CVE-2026-89090 · Updated 2026-10-15T11:24:12+00:00
  • trivy.src as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: component not present

    pkg:rpm/redhat/[email protected]?arch=src

    Red Hat · CVE-2026-89090 · Updated 2026-10-15T11:24:12+00:00

All CVSS metrics

  • MEDIUM 5.9 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
  • HIGH 8.2 v4.0 · CNA Primary
    CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  • HIGH 8.2 v4.0 · NVD Secondary
    CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • MEDIUM 5.9 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Patches & mitigations

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS