Root cause, affected code and disclosure timeline.
At a glance
Conditions
A client processing attacker-controlled event-stream headers can reach an out-of-bounds write in the streaming decoder.
What to do
Upgrade aws-c-event-stream to v0.6.0 or later and affected AWS SDK for C++ builds to the vendor's fixed version below. Check lock files as well: the AWS Common Runtime can pin an older version as a transitive dependency.
1seal reading guide, reviewed 2026-09-25 against the linked records. Not a new vendor assessment or a device rollout check.
Source assessments remain separate. Different CVSS versions are not a revision of one another. Code fixes, released versions and deployed updates are distinct evidence.
Public snapshot: 26 Sep 2026. Status, releases and attribution belong to each source below; none is inferred from another record.
acknowledgement: Oleh Konko from 1seal / 1seal.org
Note
GHSA-xvjw-fjq5-68hf / AWS-2026-011; AWS Common Runtime event-stream decoder memory corruption affecting aws-sdk-cpp <1.11.764 and other SDKs that expose event-stream functionality.
Memory Corruption in event-stream parsing of headers
Upstream publication
Upstream updated
Metadata fetched
Upstream @1seal credit
No structured @1seal credit in this snapshot; textual acknowledgements may exist.
F-AWS-EVENT-STREAM-001: Memory safety. An unbounded header-name length leads to an out-of-bounds write. Reviewed 24 Sep 2026. Mechanism assessed by 1seal.
F-AWS-EVENT-STREAM-001: Memory safety. An unbounded header-name length leads to an out-of-bounds write. Reviewed 24 Sep 2026. Mechanism assessed by 1seal.
Security area (1seal assessment): Memory safety. The streaming decoder writes beyond its header-name buffer; this is another record of the same AWS event-stream finding. Reviewed 21 Sep 2026.
This identifier groups recorded evidence; it is not an additional CVE, independent-vulnerability count or guarantee of vendor confirmation. Fixed code, released versions, attribution and independent discovery are distinct claims. Absent metadata means not recorded, not disproved. Counting rules.