VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/aws/aws-sdk-go: vulnerability history, versions and safety

github.com/aws/aws-sdk-go is a package in the Go ecosystem. Vulert records 8 vulnerabilities for it across 120 releases, from Feb 2022 to Dec 2024. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
8 vulnerabilities recorded M3 L1 U4
i
3 with no fix published

No patched version yet — these are the ones to plan around.

See the unfixed vulnerabilities →
i
0 in the last 12 months

Nothing new recorded in the last year.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/aws/aws-sdk-go vulnerabilities

Vulert verdict on github.com/aws/aws-sdk-go v1.55.8 i

Updated on 23 Oct 2026

Careful: v1.55.8 has 8 known vulnerabilities, and 3 have no fix yet. Use an earlier safe version, or the workaround listed for each one.

Package health score 45/100
  • Security Minor issues
  • Maintenance Deprecated
  • Popularity Key ecosystem project
  • Community Moderate

The registry marks the latest release as deprecated, which caps this score.

What to do: Pin an earlier, unaffected release if you can, and apply the workaround each vulnerability lists until a fix is published. No fix yet: Vulert alerts you the moment one is published. Monitor it with Vulert →

  • Current release v1.55.8 — affected i
  • Vulnerabilities on record 8 over 2 years · 0 in the last year i
  • Latest disclosure 12 Dec 2024 i
  • Highest CVSS 5.6 i
  • With no published fix 3 i
  • Stars 8,662 i
  • OpenSSF scorecard 3/10 i
  • Last release 14 months ago i
  • Licence Apache-2.0 i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/aws/aws-sdk-go, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v0.0.0-20250731160554-070853e88d22 31 Jul 2025 M3 L1 U4 Apache-2.0 No Details →
v1.55.8 31 Jul 2025 M3 L1 U4 Apache-2.0 No Details →
v1.55.8-0.20250725153514-6d9a26d85968 25 Jul 2025 M3 L1 U4 Apache-2.0 No Details →
v1.55.8-0.20250725153347-239002f260fd 25 Jul 2025 M3 L1 U4 Apache-2.0 No Details →
v1.55.7 23 Apr 2025 M3 L1 U4 Apache-2.0 No Details →
v1.55.7-0.20250121164017-8d203ccff393 21 Jan 2025 M3 L1 U4 Apache-2.0 No Details →
v1.55.6 15 Jan 2025 M3 L1 U4 Apache-2.0 No Details →
v1.55.6-0.20250115163534-5ab610339bd6 15 Jan 2025 M3 L1 U4 Apache-2.0 No Details →
v1.55.6-0.20250115163251-394e0e326196 15 Jan 2025 M3 L1 U4 Apache-2.0 No Details →
v1.55.6-0.20250115062719-19d98e37dad3 15 Jan 2025 M3 L1 U4 Apache-2.0 No Details →
v1.55.5-0.20240912145455-7112c0a0c2d0 12 Sep 2024 M3 L1 U4 Apache-2.0 No Details →
v1.55.6-0.20240912145455-7112c0a0c2d0 12 Sep 2024 M3 L1 U4 Apache-2.0 No Details →
v1.55.6-0.20240730235520-02c1f723b528 30 Jul 2024 M3 L1 U4 Apache-2.0 No Details →
v0.0.0-20240730183453-825250a3f2f4 30 Jul 2024 M3 L1 U4 Apache-2.0 No Details →
v1.55.5 30 Jul 2024 M3 L1 U4 Apache-2.0 No Details →
v1.55.5-0.20240730183453-825250a3f2f4 30 Jul 2024 M3 L1 U4 Apache-2.0 No Details →
v1.55.5-0.20240730151058-aa1178fcdbfa 30 Jul 2024 M3 L1 U4 Apache-2.0 No Details →
v1.55.4 29 Jul 2024 M3 L1 U4 Apache-2.0 No Details →
v1.55.4-0.20240729183450-d46b35a961c8 29 Jul 2024 M3 L1 U4 Apache-2.0 No Details →
v1.55.3 25 Jul 2024 M3 L1 U4 Apache-2.0 No Details →
v1.55.3-0.20240725195839-f5c0cf4254ac 25 Jul 2024 M3 L1 U4 Apache-2.0 No Details →
v1.55.3-0.20240725183711-0eb09e61ca5c 25 Jul 2024 M3 L1 U4 Apache-2.0 No Details →
v1.55.3-0.20240725182722-3800e5c7b5b0 25 Jul 2024 M3 L1 U4 Apache-2.0 No Details →
v1.55.3-0.20240724211654-f444a0786b7b 24 Jul 2024 M3 L1 U4 Apache-2.0 No Details →
v1.55.2 24 Jul 2024 M3 L1 U4 Apache-2.0 No Details →
v1.55.2-0.20240724151635-d68c8e4bd8c6 24 Jul 2024 M3 L1 U4 Apache-2.0 No Details →
v1.55.1 23 Jul 2024 M3 L1 U4 Apache-2.0 No Details →
v1.55.1-0.20240723184245-42cbf2a247d3 23 Jul 2024 M3 L1 U4 Apache-2.0 No Details →
v1.54.21-0.20240722183404-3c1fb65900e3 22 Jul 2024 M3 L1 U4 Apache-2.0 No Details →
v1.55.0 22 Jul 2024 M3 L1 U4 Apache-2.0 No Details →
v1.54.20 18 Jul 2024 M3 L1 U4 Apache-2.0 No Details →
v1.54.20-0.20240718195316-019bed03fa64 18 Jul 2024 M3 L1 U4 Apache-2.0 No Details →
v1.54.19 12 Jul 2024 M3 L1 U4 Apache-2.0 No Details →
v1.54.19-0.20240712183257-943e6659c389 12 Jul 2024 M3 L1 U4 Apache-2.0 No Details →
v1.54.18 10 Jul 2024 M3 L1 U4 Apache-2.0 No Details →
v1.54.18-0.20240710191119-fbe26bf118cf 10 Jul 2024 M3 L1 U4 Apache-2.0 No Details →
v1.54.17 09 Jul 2024 M3 L1 U4 Apache-2.0 No Details →
v1.54.17-0.20240709183513-b716b6080d0d 09 Jul 2024 M3 L1 U4 Apache-2.0 No Details →
v1.54.16 08 Jul 2024 M3 L1 U4 Apache-2.0 No Details →
v1.54.15 05 Jul 2024 M3 L1 U4 Apache-2.0 No Details →
v1.54.15-0.20240705182307-5eaabf6fe3cc 05 Jul 2024 M3 L1 U4 Apache-2.0 No Details →
v1.54.14 03 Jul 2024 M3 L1 U4 Apache-2.0 No Details →
v1.54.13 02 Jul 2024 M3 L1 U4 Apache-2.0 No Details →
v1.54.12 01 Jul 2024 M3 L1 U4 Apache-2.0 No Details →
v1.54.11 28 Jun 2024 M3 L1 U4 Apache-2.0 No Details →
v1.54.11-0.20240628193658-9607ced1cc4b 28 Jun 2024 M3 L1 U4 Apache-2.0 No Details →
v1.54.10 27 Jun 2024 M3 L1 U4 Apache-2.0 No Details →
v1.54.10-0.20240627183051-372d444f2432 27 Jun 2024 M3 L1 U4 Apache-2.0 No Details →
v1.54.9 26 Jun 2024 M3 L1 U4 Apache-2.0 No Details →
v1.54.9-0.20240626182934-b9d7c6ac103b 26 Jun 2024 M3 L1 U4 Apache-2.0 No Details →
v1.54.8 25 Jun 2024 M3 L1 U4 Apache-2.0 No Details →
v1.54.8-0.20240625183203-cce1a6342767 25 Jun 2024 M3 L1 U4 Apache-2.0 No Details →
v1.54.7 24 Jun 2024 M3 L1 U4 Apache-2.0 No Details →
v1.54.6 20 Jun 2024 M3 L1 U4 Apache-2.0 No Details →
v1.54.6-0.20240620183708-9bdfe74403d6 20 Jun 2024 M3 L1 U4 Apache-2.0 No Details →
v1.54.5 19 Jun 2024 M3 L1 U4 Apache-2.0 No Details →
v1.54.5-0.20240619183237-66bfa6bc57fb 19 Jun 2024 M3 L1 U4 Apache-2.0 No Details →
v1.54.4 18 Jun 2024 M3 L1 U4 Apache-2.0 No Details →
v1.54.4-0.20240618183622-f2d0da833d2c 18 Jun 2024 M3 L1 U4 Apache-2.0 No Details →
v1.54.3 17 Jun 2024 M3 L1 U4 Apache-2.0 No Details →
v1.54.2 14 Jun 2024 M3 L1 U4 Apache-2.0 No Details →
v1.54.2-0.20240614160912-268bb23bae8f 14 Jun 2024 M3 L1 U4 Apache-2.0 No Details →
v1.54.1 13 Jun 2024 M3 L1 U4 Apache-2.0 No Details →
v1.54.1-0.20240613183504-9df43287dd1b 13 Jun 2024 M3 L1 U4 Apache-2.0 No Details →
v1.54.0 12 Jun 2024 M3 L1 U4 Apache-2.0 No Details →
v1.53.22-0.20240611214615-f9899ddb2b69 11 Jun 2024 M3 L1 U4 Apache-2.0 No Details →
v1.53.21 11 Jun 2024 M3 L1 U4 Apache-2.0 No Details →
v1.53.20 10 Jun 2024 M3 L1 U4 Apache-2.0 No Details →
v1.53.19 07 Jun 2024 M3 L1 U4 Apache-2.0 No Details →
v1.53.19-0.20240607182507-ae77b91ecc80 07 Jun 2024 M3 L1 U4 Apache-2.0 No Details →
v1.53.18 06 Jun 2024 M3 L1 U4 Apache-2.0 No Details →
v1.53.18-0.20240606183457-f0707e2ba57c 06 Jun 2024 M3 L1 U4 Apache-2.0 No Details →
v1.53.17 05 Jun 2024 M3 L1 U4 Apache-2.0 No Details →
v1.53.16 04 Jun 2024 M3 L1 U4 Apache-2.0 No Details →
v1.53.15 03 Jun 2024 M3 L1 U4 Apache-2.0 No Details →
v0.0.0-20240531183049-905772584725 31 May 2024 M3 L1 U4 Apache-2.0 No Details →
v1.53.14 31 May 2024 M3 L1 U4 Apache-2.0 No Details →
v1.53.14-0.20240531183049-905772584725 31 May 2024 M3 L1 U4 Apache-2.0 No Details →
v1.53.13 30 May 2024 M3 L1 U4 Apache-2.0 No Details →
v1.53.13-0.20240530183953-8cc4b4b2115a 30 May 2024 M3 L1 U4 Apache-2.0 No Details →
v1.53.12 29 May 2024 M3 L1 U4 Apache-2.0 No Details →
v1.53.11 28 May 2024 M3 L1 U4 Apache-2.0 No Details →
v1.53.11-0.20240528183206-efce914c9656 28 May 2024 M3 L1 U4 Apache-2.0 No Details →
v1.53.10 24 May 2024 M3 L1 U4 Apache-2.0 No Details →
v1.53.10-0.20240524185055-2e099e6ace27 24 May 2024 M3 L1 U4 Apache-2.0 No Details →
v1.53.10-0.20240524170409-4861f8f820cd 24 May 2024 M3 L1 U4 Apache-2.0 No Details →
v0.0.0-20240524170332-a49c26df70f4 24 May 2024 M3 L1 U4 Apache-2.0 No Details →
v1.50.27-0.20240524170332-a49c26df70f4 24 May 2024 M3 L1 U4 Apache-2.0 No Details →
v1.53.9 23 May 2024 M3 L1 U4 Apache-2.0 No Details →
v1.53.9-0.20240523182842-b3e1d80886cb 23 May 2024 M3 L1 U4 Apache-2.0 No Details →
v1.53.8 22 May 2024 M3 L1 U4 Apache-2.0 No Details →
v1.53.8-0.20240522182846-cb0e3f4fb3c4 22 May 2024 M3 L1 U4 Apache-2.0 No Details →
v1.53.8-0.20240521183616-bc144f94324e 21 May 2024 M3 L1 U4 Apache-2.0 No Details →
v1.53.7 21 May 2024 M3 L1 U4 Apache-2.0 No Details →
v1.53.6 20 May 2024 M3 L1 U4 Apache-2.0 No Details →
v1.53.5 17 May 2024 M3 L1 U4 Apache-2.0 No Details →
v1.53.5-0.20240517182855-7a0e75346ae1 17 May 2024 M3 L1 U4 Apache-2.0 No Details →
v1.53.4 16 May 2024 M3 L1 U4 Apache-2.0 No Details →
v1.53.4-0.20240516183629-7561ec6e8f98 16 May 2024 M3 L1 U4 Apache-2.0 No Details →
v1.53.3 15 May 2024 M3 L1 U4 Apache-2.0 No Details →
v1.53.3-0.20240515182538-435df9a6d0eb 15 May 2024 M3 L1 U4 — No Details →
v1.53.2 14 May 2024 M3 L1 U4 — No Details →
v1.53.1 13 May 2024 M3 L1 U4 — No Details →
v1.53.1-0.20240513182751-08dfa5746eec 13 May 2024 M3 L1 U4 — No Details →
v1.52.7-0.20240510184515-e791517911bf 10 May 2024 M3 L1 U4 — No Details →
v1.53.0 10 May 2024 M3 L1 U4 — No Details →
v1.52.6 09 May 2024 M3 L1 U4 — No Details →
v1.52.5 08 May 2024 M3 L1 U4 — No Details →
v1.52.5-0.20240508182201-e7dfa8a81550 08 May 2024 M3 L1 U4 — No Details →
v1.52.4 07 May 2024 M3 L1 U4 — No Details →
v1.52.4-0.20240507183904-c638d3bee2c7 07 May 2024 M3 L1 U4 — No Details →
v1.52.3 06 May 2024 M3 L1 U4 — No Details →
v1.52.2 03 May 2024 M3 L1 U4 — No Details →
v1.52.2-0.20240503183724-417f8a94adee 03 May 2024 M3 L1 U4 — No Details →
v1.52.1 02 May 2024 M3 L1 U4 — No Details →
v1.52.1-0.20240502185006-8beb96a3de47 02 May 2024 M3 L1 U4 — No Details →
v1.51.33-0.20240501183329-09c0ee916a1c 01 May 2024 M3 L1 U4 — No Details →
v1.52.0 01 May 2024 M3 L1 U4 — No Details →
v1.51.33-0.20240430212102-debabd56846e 30 Apr 2024 M3 L1 U4 — No Details →
v1.51.32 30 Apr 2024 M3 L1 U4 — No Details →

The newest 120 of 4,895 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2022 7
  • 2024 1

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 0 of the 8 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/aws/aws-sdk-go

The 5 most severe of 8 vulnerabilities recorded for this package

Search all 8 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2020-8911: CBC padding oracle issue in AWS S3 Crypto SDK for golang 5.6 medium 1.34.0 11 Feb 2022
CVE-2022-2582: AWS S3 Crypto SDK Unencrypted Hash Leakage 4.3 medium 1.34.0 28 Dec 2022
CVE-2020-8912: In-band key negotiation issue in AWS S3 Crypto SDK for golang 2.5 low 1.34.0 11 Feb 2022
Unencrypted md5 plaintext hash in metadata in AWS S3 Crypto SDK for golang N/A medium 1.34.0 11 Feb 2022
CVE-2020-8911: CBC padding oracle issue in AWS S3 Crypto SDK for golang N/A unrated No fix published 11 Feb 2022

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/aws/aws-sdk-go

Is github.com/aws/aws-sdk-go safe to use?

Vulert records 8 vulnerabilities for github.com/aws/aws-sdk-go in Go: 0 critical, 0 high, 3 medium and 1 low, plus 4 not yet rated. 3 of them have no published fix yet, so those are the ones to avoid or mitigate.

What is github.com/aws/aws-sdk-go's Vulert package health score?

Vulert scores github.com/aws/aws-sdk-go 45/100, which reads as risky. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15). The registry marks the latest release as deprecated, which caps this score.

Is the latest version of github.com/aws/aws-sdk-go affected?

Yes. v1.55.8, the version you would install today, has 8 known vulnerabilities, and 3 has no published fix yet. Use an earlier unaffected release, or the workaround each vulnerability lists.

Which version of github.com/aws/aws-sdk-go should I use?

v1.55.7 is the version Vulert recommends for the affected releases. The version table above lists every release with the vulnerabilities recorded against it, so you can confirm the range you actually run.

How many vulnerabilities does github.com/aws/aws-sdk-go have?

8 vulnerabilities are recorded for github.com/aws/aws-sdk-go in the Go ecosystem: 0 critical, 0 high, 3 medium and 1 low, plus 4 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/aws/aws-sdk-go vulnerabilities disclosed?

0 vulnerabilities were recorded for github.com/aws/aws-sdk-go in the last 12 months, and the oldest entry in this database dates to 11 Feb 2022. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/aws/aws-sdk-go are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/aws/aws-sdk-go for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/aws/aws-sdk-go version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.