Improper input validation of the region parameter in the AWS SDK for Go v2 endpoint resolver. Each service module generated endpoints.go bound the caller-supplied region into the resolved endpoint host without validating it as a host label: "bindRegion" returned "aws.String(endpoints.MapFIPSRegion(region))" with no check, and earlier releases performed the same unvalidated assignment inline in "bindEndpointParams". An actor able to influence the region configuration value could therefore cause the SDK to construct an endpoint URL pointing at a non-existent or non-AWS host, routing API calls off-target. Fixed in the 2025-11-11 release, which rejects a region that is not a valid host label via "smithyhttp.ValidHostLabel" and propagates the error out of endpoint resolution. The advisory enumerates 406 affected service modules; the affected range for each begins where that module first generated the EndpointParameters binding, not at its first release.