[ CVE-2026-18140 · Published 30 Jul 2026 ]
aws-smithy-json: Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers
CVSS 7.5
EPSS <1%Fix available
[ Description ]Official description
Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which the smithy-rs code generator invokes from every generated struct deserializer, might allow remote unauthenticated users to cause a denial of service (process abort via stack exhaustion) via a single small HTTP request containing deeply nested JSON to a smithy-rs generated server. To remediate this issue, users should upgrade to aws-smithy-json 0.62.7 or later and rebuild.
[ Fixes ]Fixes and patches
- aws-smithy-json 0.62.7Fixed version · GitHub Advisories · rust package aws-smithy-json: upgrade to 0.62.7 or later (affected <= 0.62.6)
[ Packages ]Affected open-source packages
- aws-smithy-json rustAffected <= 0.62.6 · fixed in 0.62.7 · GHSA-8ffr-xgwf-xj56