Vulnerability-Lookup

SUSE-SU-2026:24265-1

Vulnerability from csaf_suse - Published: 2026-10-20 15:19 - Updated: 2026-10-23 09:42

Summary

Security update for amazon-ecs-init

Severity

Important

Notes

Title of the patch: Security update for amazon-ecs-init

Description of the patch: This update for amazon-ecs-init fixes the following issues: - CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers (bsc#1279042). - CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response frames containing a crafted header value type byte outside the valid range can cause the host process to terminate (bsc#1280679). Changes for amazon-ecs-init: - Update to version 1.108.0 * Enhancement - Add ECS-Init install pointer for non-Amazon Linux AMIs to README (#5161) * Enhancement - Remove direct docker run instructions from README (#5160) * Enhancement - Bump github.com/aws/aws-sdk-go-v2/config from 1.28.1 to 1.33.6 in /ecs-agent, /agent, and /ecs-init (#5159) * Feature - Enable IMDS IAM roles config resolution (#5154) * Enhancement - Bump github.com/containerd/containerd from 1.7.33 to 1.7.36 in /agent (#5155) * Enhancement - Bump github.com/containerd/containerd from 1.7.35 to 1.7.36 in /ecs-init (#5156) * Enhancement - Bump github.com/aws/aws-sdk-go-v2/service/ec2 from 1.195.0 to 1.334.0 in /ecs-agent and /agent (#5148) * Enhancement - Bump google.golang.org/grpc from 1.83.1 to 1.83.2 in /ecs-agent, /ecs-agent/daemonimages/csidriver and /agent (#5153) (bsc#1279042, CVE-2026-84445) * Enhancement - Bump go.opentelemetry.io/otel/exporters/otlp/ otlptrace/otlptracehttp from 1.43.0 to 1.45.0 in /agent (#5141) * Enhancement - IMDS credential scanner/refresher updates (#5145)

Patchnames: SUSE-SLES-16.0-1949

CVE-2026-84445

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ecs-init-0:1.108.0-160000.1.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ecs-init-0:1.108.0-160000.1.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ecs-init-0:1.108.0-160000.1.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ecs-init-0:1.108.0-160000.1.1.x86_64	—	Vendor Fix

Threats

Impact important

CVE-2026-89090

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 4 products, the same list as for CVE-2026-84445

Threats

Impact moderate

References

14 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/s…	self
https://www.suse.com/support/update/announcement/…	self
https://www.suse.com/support/update/announcement/…	self
https://bugzilla.suse.com/1279042	self
https://bugzilla.suse.com/1280679	self
https://www.suse.com/security/cve/CVE-2026-84445/	self
https://www.suse.com/security/cve/CVE-2026-89090/	self
https://www.suse.com/security/cve/CVE-2026-84445	external
https://bugzilla.suse.com/1278687	external
https://bugzilla.suse.com/1280553	external
https://bugzilla.suse.com/1280617	external
https://www.suse.com/security/cve/CVE-2026-89090	external
https://bugzilla.suse.com/1280622	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for amazon-ecs-init",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for amazon-ecs-init fixes the following issues:\n\n- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing \u0027:authority\u0027 and \u0027Host\u0027 headers in gRPC-Go xDS\n  servers (bsc#1279042).\n- CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response frames\n  containing a crafted header value type byte outside the valid range can cause the host process to terminate\n  (bsc#1280679).\n\nChanges for amazon-ecs-init:\n\n- Update to version 1.108.0\n * Enhancement - Add ECS-Init install pointer for non-Amazon Linux\n AMIs to README (#5161)\n * Enhancement - Remove direct docker run instructions from README (#5160)\n * Enhancement - Bump github.com/aws/aws-sdk-go-v2/config from 1.28.1\n to 1.33.6 in /ecs-agent, /agent, and /ecs-init (#5159)\n * Feature - Enable IMDS IAM roles config resolution (#5154)\n * Enhancement - Bump github.com/containerd/containerd from 1.7.33\n to 1.7.36 in /agent (#5155)\n * Enhancement - Bump github.com/containerd/containerd from 1.7.35\n to 1.7.36 in /ecs-init (#5156)\n * Enhancement - Bump github.com/aws/aws-sdk-go-v2/service/ec2 from\n 1.195.0 to 1.334.0 in /ecs-agent and /agent (#5148)\n * Enhancement - Bump google.golang.org/grpc from 1.83.1 to 1.83.2\n in /ecs-agent, /ecs-agent/daemonimages/csidriver and /agent (#5153)\n (bsc#1279042, CVE-2026-84445)\n * Enhancement - Bump go.opentelemetry.io/otel/exporters/otlp/\n otlptrace/otlptracehttp from 1.43.0 to 1.45.0 in /agent (#5141)\n * Enhancement - IMDS credential scanner/refresher updates (#5145)\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLES-16.0-1949",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_24265-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:24265-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202624265-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:24265-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202624265-1/"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1279042",
        "url": "https://bugzilla.suse.com/1279042"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1280679",
        "url": "https://bugzilla.suse.com/1280679"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-84445 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-84445/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-89090 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-89090/"
      }
    ],
    "title": "Security update for amazon-ecs-init",
    "tracking": {
      "current_release_date": "2026-10-23T09:42:20Z",
      "generator": {
        "date": "2026-10-20T15:19:51Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:24265-1",
      "initial_release_date": "2026-10-20T15:19:51Z",
      "revision_history": [
        {
          "date": "2026-10-20T15:19:51Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-10-23T09:42:20Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "amazon-ecs-init-0:1.108.0-160000.1.1.aarch64",
                "product": {
                  "name": "amazon-ecs-init-0:1.108.0-160000.1.1.aarch64",
                  "product_id": "amazon-ecs-init-0:1.108.0-160000.1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/amazon-ecs-init@1.108.0-160000.1.1?arch=aarch64\u0026upstream=amazon-ecs-init-0:1.108.0-160000.1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "amazon-ecs-init-0:1.108.0-160000.1.1.x86_64",
                "product": {
                  "name": "amazon-ecs-init-0:1.108.0-160000.1.1.x86_64",
                  "product_id": "amazon-ecs-init-0:1.108.0-160000.1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/amazon-ecs-init@1.108.0-160000.1.1?arch=x86_64\u0026upstream=amazon-ecs-init-0:1.108.0-160000.1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 16.0",
                "product": {
                  "name": "SUSE Linux Enterprise Server 16.0",
                  "product_id": "SUSE Linux Enterprise Server 16.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:16:16.0:server"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP applications 16.0",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP applications 16.0",
                  "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:16:16.0:server-sap"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "amazon-ecs-init-0:1.108.0-160000.1.1.aarch64 as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:amazon-ecs-init-0:1.108.0-160000.1.1.aarch64"
        },
        "product_reference": "amazon-ecs-init-0:1.108.0-160000.1.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "amazon-ecs-init-0:1.108.0-160000.1.1.x86_64 as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:amazon-ecs-init-0:1.108.0-160000.1.1.x86_64"
        },
        "product_reference": "amazon-ecs-init-0:1.108.0-160000.1.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "amazon-ecs-init-0:1.108.0-160000.1.1.aarch64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ecs-init-0:1.108.0-160000.1.1.aarch64"
        },
        "product_reference": "amazon-ecs-init-0:1.108.0-160000.1.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "amazon-ecs-init-0:1.108.0-160000.1.1.x86_64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ecs-init-0:1.108.0-160000.1.1.x86_64"
        },
        "product_reference": "amazon-ecs-init-0:1.108.0-160000.1.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-84445",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-84445"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go assumes that an authority value exists and indexes the empty slice. A remote client that can complete transport connection establishment can trigger an index-out-of-bounds panic that is not recovered by the per-RPC goroutine and terminates the entire server process. In insecure or ordinary TLS deployments the request can be unauthenticated, while strict mTLS or ALTS deployments require valid transport credentials before the malformed RPC can reach the interceptor. This issue is fixed in versions 1.82.2 and 1.83.2.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:amazon-ecs-init-0:1.108.0-160000.1.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:amazon-ecs-init-0:1.108.0-160000.1.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ecs-init-0:1.108.0-160000.1.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ecs-init-0:1.108.0-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-84445",
          "url": "https://www.suse.com/security/cve/CVE-2026-84445"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1278687 for CVE-2026-84445",
          "url": "https://bugzilla.suse.com/1278687"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1280553 for CVE-2026-84445",
          "url": "https://bugzilla.suse.com/1280553"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1280617 for CVE-2026-84445",
          "url": "https://bugzilla.suse.com/1280617"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:amazon-ecs-init-0:1.108.0-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:amazon-ecs-init-0:1.108.0-160000.1.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ecs-init-0:1.108.0-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ecs-init-0:1.108.0-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:amazon-ecs-init-0:1.108.0-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:amazon-ecs-init-0:1.108.0-160000.1.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ecs-init-0:1.108.0-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ecs-init-0:1.108.0-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-20T15:19:51Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-84445"
    },
    {
      "cve": "CVE-2026-89090",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-89090"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response frame containing a header value type outside the valid range.\n\n\n\nTo remediate this issue, users should upgrade to release-2026-03-23 or later, and patch any forked or derivative code.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:amazon-ecs-init-0:1.108.0-160000.1.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:amazon-ecs-init-0:1.108.0-160000.1.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ecs-init-0:1.108.0-160000.1.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ecs-init-0:1.108.0-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-89090",
          "url": "https://www.suse.com/security/cve/CVE-2026-89090"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1280622 for CVE-2026-89090",
          "url": "https://bugzilla.suse.com/1280622"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:amazon-ecs-init-0:1.108.0-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:amazon-ecs-init-0:1.108.0-160000.1.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ecs-init-0:1.108.0-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ecs-init-0:1.108.0-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:amazon-ecs-init-0:1.108.0-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:amazon-ecs-init-0:1.108.0-160000.1.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ecs-init-0:1.108.0-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ecs-init-0:1.108.0-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-20T15:19:51Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-89090"
    }
  ]
}

CVE-2026-84445 (GCVE-0-2026-84445)

Vulnerability from cvelistv5 – Published: 2026-09-14 16:11 – Updated: 2026-09-14 16:36

Title

gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers

Summary

gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go assumes that an authority value exists and indexes the empty slice. A remote client that can complete transport connection establishment can trigger an index-out-of-bounds panic that is not recovered by the per-RPC goroutine and terminates the entire server process. In insecure or ordinary TLS deployments the request can be unauthenticated, while strict mTLS or ALTS deployments require valid transport credentials before the malformed RPC can reach the interceptor. This issue is fixed in versions 1.82.2 and 1.83.2.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-14 16:36 UTC

CWE

CWE-129 - Improper Validation of Array Index
CWE-248 - Uncaught Exception

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7798 records in the last 180 days details

References

10 references

URL	Tags
https://github.com/grpc/grpc-go/security/advisori…	x_refsource_CONFIRM
https://github.com/grpc/grpc-go/issues/9354	x_refsource_MISC
https://github.com/grpc/grpc-go/pull/9365	x_refsource_MISC
https://github.com/grpc/grpc-go/pull/9366	x_refsource_MISC
https://github.com/grpc/grpc-go/pull/9367	x_refsource_MISC
https://github.com/grpc/grpc-go/commit/3822494d8e…	x_refsource_MISC
https://github.com/grpc/grpc-go/commit/8668b69c16…	x_refsource_MISC
https://github.com/grpc/grpc-go/commit/93e31b4854…	x_refsource_MISC
https://github.com/grpc/grpc-go/releases/tag/v1.82.2	x_refsource_MISC
https://github.com/grpc/grpc-go/releases/tag/v1.83.2	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
grpc	grpc-go	Affected: < 1.82.2 Affected: >= 1.83.0, < 1.83.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-84445",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T16:36:00.554548Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T16:36:14.966Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "grpc-go",
          "vendor": "grpc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.82.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.83.0, \u003c 1.83.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go assumes that an authority value exists and indexes the empty slice. A remote client that can complete transport connection establishment can trigger an index-out-of-bounds panic that is not recovered by the per-RPC goroutine and terminates the entire server process. In insecure or ordinary TLS deployments the request can be unauthenticated, while strict mTLS or ALTS deployments require valid transport credentials before the malformed RPC can reach the interceptor. This issue is fixed in versions 1.82.2 and 1.83.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-129",
              "description": "CWE-129: Improper Validation of Array Index",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "CWE-248: Uncaught Exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T16:11:41.401Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj"
        },
        {
          "name": "https://github.com/grpc/grpc-go/issues/9354",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-go/issues/9354"
        },
        {
          "name": "https://github.com/grpc/grpc-go/pull/9365",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-go/pull/9365"
        },
        {
          "name": "https://github.com/grpc/grpc-go/pull/9366",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-go/pull/9366"
        },
        {
          "name": "https://github.com/grpc/grpc-go/pull/9367",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-go/pull/9367"
        },
        {
          "name": "https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7"
        },
        {
          "name": "https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4"
        },
        {
          "name": "https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f"
        },
        {
          "name": "https://github.com/grpc/grpc-go/releases/tag/v1.82.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-go/releases/tag/v1.82.2"
        },
        {
          "name": "https://github.com/grpc/grpc-go/releases/tag/v1.83.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-go/releases/tag/v1.83.2"
        }
      ],
      "source": {
        "advisory": "GHSA-2v4p-qf9q-27wj",
        "discovery": "UNKNOWN"
      },
      "title": "gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-84445",
    "datePublished": "2026-09-14T16:11:41.401Z",
    "dateReserved": "2026-09-01T20:05:09.422Z",
    "dateUpdated": "2026-09-14T16:36:14.966Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-89090 (GCVE-0-2026-89090)

Vulnerability from cvelistv5 – Published: 2026-09-11 17:03 – Updated: 2026-09-24 19:29

Title

Denial of service in the event stream header decoder in AWS SDK for Go v2

Summary

An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response frame containing a header value type outside the valid range. To remediate this issue, users should upgrade to release-2026-03-23 or later, and patch any forked or derivative code.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

8.2 (High)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-11 19:19 UTC

CWE

CWE-248 - Uncaught exception

Assigner

AMZN CNA under the mitre root

CNA scorecard A 94/100 over 139 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/aws/aws-sdk-go-v2/security/adv…	third-party-advisory
https://github.com/aws/aws-sdk-go-v2/releases/tag…	patch
https://aws.amazon.com/security/security-bulletin…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
AWS	AWS SDK for Go v2	Affected: 0 , < 2026-03-23 (custom) cpe:2.3:a:aws:aws_sdk_for_go_v2::::::::

Credits

1Seal

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89090",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-11T19:19:50.301461Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-11T19:20:01.797Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "AWS SDK for Go v2",
          "vendor": "AWS",
          "versions": [
            {
              "lessThan": "2026-03-23",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:aws:aws_sdk_for_go_v2:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2026-03-23",
                  "versionStartIncluding": "0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "1Seal"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAn unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response frame containing a header value type outside the valid range.\u003c/p\u003e\u003cp\u003eTo remediate this issue, users should upgrade to release-2026-03-23 or later, and patch any forked or derivative code.\u003c/p\u003e"
            }
          ],
          "value": "An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response frame containing a header value type outside the valid range.\n\n\n\nTo remediate this issue, users should upgrade to release-2026-03-23 or later, and patch any forked or derivative code."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-153",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-153 Input Data Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "CWE-248 Uncaught exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T19:29:25.970Z",
        "orgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
        "shortName": "AMZN"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://github.com/aws/aws-sdk-go-v2/security/advisories/GHSA-xmrv-pmrh-hhx2"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://aws.amazon.com/security/security-bulletins/2026-110-aws/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Denial of service in the event stream header decoder in AWS SDK for Go v2",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
    "assignerShortName": "AMZN",
    "cveId": "CVE-2026-89090",
    "datePublished": "2026-09-11T17:03:33.351Z",
    "dateReserved": "2026-09-10T20:14:45.885Z",
    "dateUpdated": "2026-09-24T19:29:25.970Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

SUSE-SU-2026:24265-1

CVE-2026-84445 (GCVE-0-2026-84445)

CVE-2026-89090 (GCVE-0-2026-89090)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour