🟠 High | Source: AWS Security Bulletins
A vulnerability (CVE-2026-15957) in the smithy-rs Rust code generation framework allows an unauthenticated attacker to crash any service built with it by sending a small HTTP request containing deeply nested data structures. The flaw affects JSON, CBOR, and XML deserialisers generated by smithy-rs, triggering a stack overflow and process abort. Any application using aws-sdk-rust crates prior to release-2026-06-0 is exposed, including custom Smithy-generated servers.
Security Architect’s Take: Audit your Rust-based workloads and pipelines for any use of aws-sdk-rust or custom smithy-rs-generated servers, and update all affected crates to release-2026-06-0 or later immediately — the unauthenticated, low-effort nature of this DoS makes it a straightforward target for disruption of production services.
Original advisory: CVE-2026-15957 - Uncontrolled recursion in smithy-rs generated JSON, CBOR, and XML deserializers allows unauthenticated remote denial of service via recursive shapes