🟠 High | Source: AWS Security Bulletins
A vulnerability in the aws-smithy-json library allows an unauthenticated remote attacker to trigger uncontrolled recursion when a smithy-rs generated server processes JSON with unknown keys, causing a denial of service. This affects services built using AWS’s Smithy framework for Rust, which is used to generate server-side SDKs. The flaw requires no authentication to exploit, making it straightforward for an attacker to crash affected services.
Security Architect’s Take: Identify any internal or customer-facing services built with smithy-rs and update the aws-smithy-json dependency to the patched version immediately — pay particular attention to public-facing APIs where unauthenticated input is accepted, as these carry the highest exposure.
Original advisory: CVE-2026-18140 - Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers