CVE-2026-5190: 
Linux openSUSE vulnerability analysis and mitigation

CVE-2026-5190 is a stack buffer overflow (out-of-bounds write) vulnerability in the streaming decoder component of aws-c-event-stream, an AWS Common Runtime library used by multiple AWS SDKs for event-stream protocol communication. A third party operating a server can send specially crafted event-stream messages to cause memory corruption, potentially leading to arbitrary code execution on the client application. The vulnerability affects aws-c-event-stream versions before 0.6.0, as well as several higher-level SDK libraries that expose event-stream functionality. It was published on March 31, 2026, and carries a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 7.7 (High) (AWS Security Bulletin, GitHub Advisory).

The root cause is an out-of-bounds write (CWE-787) in the event-stream header parsing logic of the streaming decoder component. When a client application processes event-stream messages from a server, insufficient bounds checking allows a malicious server to supply crafted header data that overflows a stack buffer, corrupting adjacent memory. Exploitation requires high attack complexity (the attacker must control the server the client connects to) and passive user interaction (the client must initiate a connection and process messages). The fix, released as v0.6.0, addresses a possible overflow in the decode buffer, as noted in the GitHub release (GitHub Release, GitHub Advisory).

Successful exploitation allows a threat actor controlling a server to cause memory corruption on a connecting client application, potentially achieving arbitrary code execution with the privileges of the client process. This could result in full compromise of confidentiality, integrity, and availability of the affected client system. Notably, AWS-operated services such as AWS Transcribe and AWS Kinesis are not impacted — the risk is limited to scenarios where a client communicates with a third-party or attacker-controlled server using the event-stream protocol (AWS Security Bulletin, GitHub Advisory).

1. Identify target clients: Identify client applications that use aws-c-event-stream < 0.6.0 or affected SDK versions (e.g., aws-iot-device-sdk-cpp-v2 < 1.42.1, aws-sdk-cpp < 1.11.764) and communicate with non-AWS event-stream servers.
2. Establish server control: Set up or compromise a server that the target client application is configured to connect to using the event-stream protocol (e.g., a custom IoT endpoint or third-party service).
3. Craft malicious event-stream message: Construct a specially formatted event-stream message with header data designed to overflow the streaming decoder's stack buffer — exploiting the lack of bounds checking in the header parsing logic.
4. Deliver payload: When the client connects and begins processing event-stream messages, send the crafted message to trigger the out-of-bounds write, corrupting stack memory.
5. Achieve code execution: Leverage the memory corruption to redirect execution flow (e.g., overwrite return address or function pointer) and execute arbitrary code in the context of the client application process (AWS Security Bulletin, GitHub Advisory).

• Network: Unexpected outbound connections from client applications to non-AWS or unrecognized event-stream servers; anomalous traffic patterns on event-stream protocol ports from SDK-based applications.
• Process: Unusual child processes spawned by AWS SDK client applications (e.g., shells, scripting interpreters); unexpected process crashes or core dumps in applications using aws-c-event-stream.
• Logs: Application crash logs or stack traces referencing the event-stream decoder component; memory access violation errors in SDK-based client applications.
• File System: Unexpected files or scripts written by the client application process; new persistence mechanisms (cron jobs, scheduled tasks) created under the client application's user account.

AWS has released patched versions addressing this vulnerability. Users should upgrade to the following minimum versions: aws-c-event-stream ≥ 0.6.0, aws-iot-device-sdk-cpp-v2 ≥ 1.42.1, aws-iot-device-sdk-java-v2 ≥ 1.30.1, aws-iot-device-sdk-python-v2 ≥ 1.28.2, aws-iot-device-sdk-js-v2 ≥ 1.25.1, aws-sdk-swift ≥ 1.6.70, and aws-sdk-cpp ≥ 1.11.764. As a workaround for those unable to upgrade immediately, ensure that client applications only communicate with trusted servers using the event-stream protocol, as AWS-operated servers will not trigger this issue. Any forked or derivative code incorporating aws-c-event-stream should also be patched (AWS Security Bulletin, GitHub Advisory).

The vulnerability was discovered and responsibly disclosed by Oleh Konko from 1seal.org through coordinated vulnerability disclosure with AWS Security. AWS published a security bulletin (2026-011-AWS) and a GitHub Security Advisory (GHSA-xvjw-fjq5-68hf) on March 31, 2026. OpenSUSE issued a security announcement for its packaged version of aws-c-event-stream, and Tenable added a Nessus detection plugin (ID 305836). Community discussion was limited, with brief mentions on Mastodon and security feed aggregators (AWS Security Bulletin, GitHub Advisory).