🟠 High | Source: AWS Security Bulletins
A vulnerability (CVE-2026-16756) in the Smithy-RS framework’s aws-smithy-http-server crate allows unauthenticated attackers to perform a Slowloris-style denial-of-service attack by exhausting server resources without any request limits in place. The flaw affects all versions of aws-smithy-http-server up to and including 0.66.4. Any Rust-based HTTP server built using Smithy-RS and exposed to untrusted networks is potentially at risk.
Security Architect’s Take: Identify any internal or customer-facing services built with aws-smithy-http-server and upgrade to a patched version above 0.66.4 immediately; as an interim control, place a load balancer or reverse proxy with request timeout and connection-limiting policies in front of affected services to mitigate Slowloris exposure.
Original advisory: CVE-2026-16756 - Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service