Security: GHSA-xmrv-pmrh-hhx2 — aws-sdk-go-v2/service/lambda v1.88.0 DoS via malformed EventStream frame

[vidhya03]

Description

Running a Twistlock / Prisma Cloud scan against temporalio/server:1.31.1 and temporalio/admin-tools:1.31.1 surfaces GHSA-xmrv-pmrh-hhx2 in the bundled github.com/aws/aws-sdk-go-v2/service/lambda dependency.

Vulnerability details

Field	Detail
GHSA	GHSA-xmrv-pmrh-hhx2
Advisory	GHSA-xmrv-pmrh-hhx2
AWS advisory	GHSA-xmrv-pmrh-hhx2
Package	github.com/aws/aws-sdk-go-v2/service/lambda
Bundled version	v1.88.0 (confirmed via go.sum in temporal v1.31.1)
Fixed version	v1.88.5 (requires aws/protocol/eventstream ≥ v1.7.8)
Severity	MODERATE — CVSS 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Published	April 7, 2026

Root cause

The AWS SDK for Go v2 EventStream header decoder does not validate the header value type byte before processing. A remote actor can send a malformed EventStream response frame with an out-of-range type byte, triggering a runtime panic and terminating the host process. This is a network-reachable DoS with no authentication required.

Confirmed affected images

• temporalio/server:1.31.1
• temporalio/admin-tools:1.31.1

Suggested fix

Bump github.com/aws/aws-sdk-go-v2/service/lambda to v1.88.5 and ensure github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream is at v1.7.8 or later.

go get github.com/aws/aws-sdk-go-v2/service/lambda@v1.88.5
go mod tidy

[vidhya03]

Relates to / possible duplicate of #9863 which was closed in April 2026,
however temporalio/server:1.31.1 (released Apr 29 2026) still ships
aws-sdk-go-v2/service/lambda v1.88.0 — the fix (v1.88.5) does not appear
to have landed in a release yet. Reopening the tracking here.