temporalio / temporalio/temporal
Security: GHSA-xmrv-pmrh-hhx2 — aws-sdk-go-v2/service/lambda v1.88.0 DoS via malformed EventStream frame
@yycptt is already working on this.
Since Jul 9, 2026.
- Dominant language
- Go
- Stars
- 23.2k
- Forks
- 1.9k
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 228
Description
Description
Running a Twistlock / Prisma Cloud scan against temporalio/server:1.31.1 and temporalio/admin-tools:1.31.1 surfaces GHSA-xmrv-pmrh-hhx2 in the bundled github.com/aws/aws-sdk-go-v2/service/lambda dependency.
Vulnerability details
| Field | Detail |
|---|---|
| GHSA | GHSA-xmrv-pmrh-hhx2 |
| Advisory | https://github.com/advisories/GHSA-xmrv-pmrh-hhx2 |
| AWS advisory | https://github.com/aws/aws-sdk-go-v2/security/advisories/GHSA-xmrv-pmrh-hhx2 |
| Package | github.com/aws/aws-sdk-go-v2/service/lambda |
| Bundled version | v1.88.0 (confirmed via go.sum in temporal v1.31.1) |
| Fixed version | v1.88.5 (requires aws/protocol/eventstream ≥ v1.7.8) |
| Severity | MODERATE — CVSS 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) |
| Published | April 7, 2026 |
Root cause
The AWS SDK for Go v2 EventStream header decoder does not validate the header value type byte before processing. A remote actor can send a malformed EventStream response frame with an out-of-range type byte, triggering a runtime panic and terminating the host process. This is a network-reachable DoS with no authentication required.
Confirmed affected images
temporalio/server:1.31.1temporalio/admin-tools:1.31.1
Suggested fix
Bump github.com/aws/aws-sdk-go-v2/service/lambda to v1.88.5 and ensure github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream is at v1.7.8 or later.
go get github.com/aws/aws-sdk-go-v2/service/lambda@v1.88.5
go mod tidy
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.