fix(security/unknown/): update module github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream to v1.7.8 [security]

[renovate-sh-app]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream	v1.6.2 → v1.7.8

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder

GHSA-xmrv-pmrh-hhx2

More information

Details

CVSSv3.1 Rating: [Medium]
CVSSv3.1 Score: [5.9]
CVSSv3.1 Vector String: [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H]

Summary and Impact

An issue exists in the the EventStream header decoder in AWS SDK for Go v2 in versions predating 2026-03-23. An actor can send a malformed EventStream response frame containing a crafted header value type byte outside the valid range, which can cause the host process to terminate.

Impacted versions: < 2026-03-23

Patches

This issue has been addressed in versions 2026-03-23 and above. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds

Not Applicable

References

If you have any questions or comments about this advisory, we ask that you contact [AWS/Amazon] Security via our vulnerability reporting page or directly via email to [email protected]. Please do not create a public GitHub issue.

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/aws/aws-sdk-go-v2/security/advisories/GHSA-xmrv-pmrh-hhx2
• https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23
• https://github.com/advisories/GHSA-xmrv-pmrh-hhx2

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder

GHSA-xmrv-pmrh-hhx2 / GO-2026-5764

More information

Details

CVSSv3.1 Rating: [Medium]
CVSSv3.1 Score: [5.9]
CVSSv3.1 Vector String: [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H]

Summary and Impact

An issue exists in the the EventStream header decoder in AWS SDK for Go v2 in versions predating 2026-03-23. An actor can send a malformed EventStream response frame containing a crafted header value type byte outside the valid range, which can cause the host process to terminate.

Impacted versions: < 2026-03-23

Patches

This issue has been addressed in versions 2026-03-23 and above. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds

Not Applicable

References

If you have any questions or comments about this advisory, we ask that you contact [AWS/Amazon] Security via our vulnerability reporting page or directly via email to [email protected]. Please do not create a public GitHub issue.

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/aws/aws-sdk-go-v2/security/advisories/GHSA-xmrv-pmrh-hhx2
• https://github.com/aws/aws-sdk-go-v2
• https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

DoS due to Panic in AWS SDK for Go v2 SDK EventStream Decoder in github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream

GHSA-xmrv-pmrh-hhx2 / GO-2026-5764

More information

Details

DoS due to Panic in AWS SDK for Go v2 SDK EventStream Decoder in github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream

Severity

Unknown

References

• https://github.com/aws/aws-sdk-go-v2/security/advisories/GHSA-xmrv-pmrh-hhx2
• https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Release Notes

aws/aws-sdk-go-v2 (github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream)

v1.7.3

General Highlights

• Dependency Update: Updated to the latest SDK module versions

Module Highlights

• github.com/aws/aws-sdk-go-v2/config: v1.26.6
  • Bug Fix: Remove invalid escaping of shared config values. All values in the shared config file will now be interpreted literally, save for fully-quoted strings which are unwrapped for legacy reasons.
• github.com/aws/aws-sdk-go-v2/internal/ini: v1.7.3
  • Bug Fix: Remove invalid escaping of shared config values. All values in the shared config file will now be interpreted literally, save for fully-quoted strings which are unwrapped for legacy reasons.
• github.com/aws/aws-sdk-go-v2/service/appconfigdata: v1.12.0
  • Feature: Fix FIPS Endpoints in aws-us-gov.
• github.com/aws/aws-sdk-go-v2/service/cloud9: v1.22.7
  • Documentation: Doc-only update around removing AL1 from list of available AMIs for Cloud9
• github.com/aws/aws-sdk-go-v2/service/cloudfrontkeyvaluestore: v1.2.0
  • Feature: This release improves upon the DescribeKeyValueStore API by returning two additional fields, Status of the KeyValueStore and the FailureReason in case of failures during creation of KeyValueStore.
• github.com/aws/aws-sdk-go-v2/service/connectcases: v1.13.0
  • Feature: This release adds the ability to view audit history on a case and introduces a new parameter, performedBy, for CreateCase and UpdateCase API's.
• github.com/aws/aws-sdk-go-v2/service/ec2: v1.144.1
  • Documentation: Documentation updates for Amazon EC2.
• github.com/aws/aws-sdk-go-v2/service/ecs: v1.38.0
  • Feature: This release adds support for Transport Layer Security (TLS) and Configurable Timeout to ECS Service Connect. TLS facilitates privacy and data security for inter-service communications, while Configurable Timeout allows customized per-request timeout and idle timeout for Service Connect services.
• github.com/aws/aws-sdk-go-v2/service/organizations: v1.23.7
  • Documentation: Doc only update for quota increase change
• github.com/aws/aws-sdk-go-v2/service/rds: v1.67.0
  • Feature: Introduced support for the InsufficientDBInstanceCapacityFault error in the RDS CreateDBCluster API method. This provides enhanced error handling, ensuring a more robust experience when creating database clusters with insufficient instance capacity.

v1.7.2

General Highlights

• Dependency Update: Updated to the latest SDK module versions

Module Highlights

• github.com/aws/aws-sdk-go-v2/service/amp: v1.34.0
  • Feature: Add QueryLoggingConfiguration APIs for Amazon Managed Prometheus
• github.com/aws/aws-sdk-go-v2/service/auditmanager: v1.39.0
  • Feature: With this release, the AssessmentControl description field has been deprecated, as of May 19, 2025. Additionally, the UpdateAssessment API can now return a ServiceQuotaExceededException when applicable service quotas are exceeded.
• github.com/aws/aws-sdk-go-v2/service/dsql: v1.5.0
  • Feature: Features: support for customer managed encryption keys
• github.com/aws/aws-sdk-go-v2/service/glue: v1.113.0
  • Feature: This release supports additional ConversionSpec parameter as part of IntegrationPartition Structure in CreateIntegrationTableProperty API. This parameter is referred to apply appropriate column transformation for columns that are used for timestamp based partitioning
• github.com/aws/aws-sdk-go-v2/service/internal/checksum: v1.7.2
  • Bug Fix: Handle checksum for unseekable body with 0 content length

v1.7.1

General Highlights

• Dependency Update: Updated to the latest SDK module versions

Module Highlights

• github.com/aws/aws-sdk-go-v2/service/acm: v1.32.0
  • Feature: Add support for file-based HTTP domain control validation, available through Amazon CloudFront.
• github.com/aws/aws-sdk-go-v2/service/cloudfront: v1.46.0
  • Feature: Add distribution tenant, connection group, and multi-tenant distribution APIs to the CloudFront SDK.
• github.com/aws/aws-sdk-go-v2/service/dynamodb: v1.43.1
  • Documentation: Doc only update for GSI descriptions.
• github.com/aws/aws-sdk-go-v2/service/imagebuilder: v1.42.0
  • Feature: Add integration with SSM Parameter Store to Image Builder.
• github.com/aws/aws-sdk-go-v2/service/internal/checksum: v1.7.1
  • Bug Fix: Don't emit warnings about lack of checksum validation for non-200 responses.

v1.7.0

General Highlights

• Dependency Update: Updated to the latest SDK module versions

Module Highlights

• github.com/aws/aws-sdk-go-v2/service/ec2: v1.209.0
  • Feature: This release adds the GroupLongName field to the response of the DescribeAvailabilityZones API.
• github.com/aws/aws-sdk-go-v2/service/ecr: v1.43.0
  • Feature: This release adds Amazon ECR to Amazon ECR pull through cache rules support.
• github.com/aws/aws-sdk-go-v2/service/ecs: v1.54.2
  • Documentation: This is a documentation only update for Amazon ECS to address various tickets.
• github.com/aws/aws-sdk-go-v2/service/inspector2: v1.36.0
  • Feature: Adding componentArn to network reachability details
• github.com/aws/aws-sdk-go-v2/service/internal/checksum: v1.7.0
  • Feature: Add extra check during output checksum validation so the validation skip warning would not be logged if object is not fetched from s3
• github.com/aws/aws-sdk-go-v2/service/medialive: v1.71.0
  • Feature: Add an enum option DISABLED for Output Locking Mode under Global Configuration.

v1.6.9

General Highlights

• Dependency Update: Updated to the latest SDK module versions

Module Highlights

• github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: v1.6.9
  • Bug Fix: Remove max limit on event stream messages
• github.com/aws/aws-sdk-go-v2/service/codebuild: v1.52.0
  • Feature: Added test suite names to test case metadata
• github.com/aws/aws-sdk-go-v2/service/connect: v1.125.0
  • Feature: Release Notes: 1) Analytics API enhancements: Added new ListAnalyticsDataLakeDataSets API. 2) Onboarding API Idempotency: Adds ClientToken to instance creation and management APIs to support idempotency.
• github.com/aws/aws-sdk-go-v2/service/databasemigrationservice: v1.48.0
  • Feature: Introduces premigration assessment feature to DMS Serverless API for start-replication and describe-replications
• github.com/aws/aws-sdk-go-v2/service/rdsdata: v1.27.0
  • Feature: Add support for Stop DB feature.
• github.com/aws/aws-sdk-go-v2/service/s3: v1.77.0
  • Feature: Added support for Content-Range header in HeadObject response.
• github.com/aws/aws-sdk-go-v2/service/wafv2: v1.56.0
  • Feature: The WAFv2 API now supports configuring data protection in webACLs.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

Need help?

You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.

[renovate-sh-app]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

Command failed: go get -t ./...
go: github.com/prometheus/[email protected] (replaced by github.com/grafana/[email protected]): version "v0.12.2-0.20231005125903-364b9c41e595" invalid: unknown revision 364b9c41e595