Description
An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response frame containing a header value type outside the valid range.
To remediate this issue, users should upgrade to release-2026-03-23 or later, and patch any forked or derivative code.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| AWS | AWS SDK for Go v2 | < 2026-03-23 | 2026-03-23 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | alloy | 1.19.2-150700.15.29.1 | SUSE-SU-2026:4408-1 |
| SLES 12 SP5 | docker | 28.5.1_ce-98.154.1 | SUSE-SU-2026:5182-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | alloy | 1.19.2-160000.1.1 | SUSE-SU-2026:24148-1 |
| SLES for SAP 16.0 | amazon-ecs-init | 1.108.0-160000.1.1 | SUSE-SU-2026:24265-1 |
| SLES 16.0 | alloy | 1.19.2-160000.1.1 | SUSE-SU-2026:24148-1 |
| SLES 16.0 | amazon-ecs-init | 1.108.0-160000.1.1 | SUSE-SU-2026:24265-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | alloy | 1.19.2-1.1 | openSUSE-SU-2026:11803-1 |
| openSUSE Tumbleweed | amazon-cloudwatch-agent | 1.300073.0-3.1 | openSUSE-SU-2026:12208-1 |
| openSUSE Tumbleweed | amazon-ecs-init | 1.108.0-1.1 | openSUSE-SU-2026:12107-1 |
| openSUSE Tumbleweed | keybase-client | 6.6.3-5.1 | openSUSE-SU-2026:11821-1 |
| openSUSE Tumbleweed | rqlite | 10.6.1-1.1 | openSUSE-SU-2026:12186-1 |
| openSUSE Leap 16.0 | alloy | 1.19.2-160000.1.1 | openSUSE-SU-2026:22032-1 |
| openSUSE Leap 16.0 | amazon-ecs-init | 1.108.0-160000.1.1 | openSUSE-SU-2026:22145-1 |
| openSUSE Leap 16.0 | keybase-client | 6.6.3-bp160.4.1 | openSUSE-SU-2026:21925-1 |
| openSUSE Leap 16.0 | rqlite | 10.6.6-bp160.1.1 | openSUSE-SU-2026:22224-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | credentials-fetcher | 2.0.3-1.amzn2023.0.8 | ALAS2023-2026-3360 |
Affected packages
Advisories 14
- SUSE-SU-2026:5182-1 Security update for docker SUSE / openSUSE Security Updates · Nov 11, 2026
- ALAS2023-2026-3360 Moderate: credentials-fetcher security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 11, 2026
- openSUSE-SU-2026:22224-1 Security update for rqlite SUSE / openSUSE Security Updates · Nov 4, 2026
- openSUSE-SU-2026:22145-1 Security update for amazon-ecs-init SUSE / openSUSE Security Updates · Oct 23, 2026
- SUSE-SU-2026:24265-1 Security update for amazon-ecs-init SUSE / openSUSE Security Updates · Oct 23, 2026
- openSUSE-SU-2026:12208-1 amazon-cloudwatch-agent-1.300073.0-3.1 on GA media SUSE / openSUSE Security Updates · Oct 22, 2026
- openSUSE-SU-2026:12186-1 rqlite-10.6.1-1.1 on GA media SUSE / openSUSE Security Updates · Oct 19, 2026
- SUSE-SU-2026:24148-1 Security update for alloy SUSE / openSUSE Security Updates · Oct 16, 2026
- openSUSE-SU-2026:12107-1 amazon-ecs-init-1.108.0-1.1 on GA media SUSE / openSUSE Security Updates · Oct 13, 2026
- openSUSE-SU-2026:22032-1 Security update for alloy SUSE / openSUSE Security Updates · Oct 9, 2026
- SUSE-SU-2026:4408-1 Security update for alloy SUSE / openSUSE Security Updates · Oct 1, 2026
- openSUSE-SU-2026:21925-1 Security update for keybase-client SUSE / openSUSE Security Updates · Sep 25, 2026
- openSUSE-SU-2026:11821-1 kbfs-6.6.3-5.1 on GA media SUSE / openSUSE Security Updates · Sep 20, 2026
- openSUSE-SU-2026:11803-1 alloy-1.19.2-1.1 on GA media SUSE / openSUSE Security Updates · Sep 18, 2026