CVE-2026-18140 · GHSA-8ffr-xgwf-xj56
aws-smithy-json: Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers
- Risk score
- 57/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 30 Jul 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which the smithy-rs code generator invokes from every generated struct deserializer, might allow remote unauthenticated users to cause a denial of service (process abort via stack exhaustion) via a single small HTTP…
- Affected
- aws-smithy-json (rust) <= 0.62.6
- Fix
- Upgrade aws-smithy-json to 0.62.7 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.5 high
- Remotely exploitable without logging in
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| aws-smithy-json | rust | <= 0.62.6 | 0.62.7 |
References
- https://github.com/advisories/GHSA-8ffr-xgwf-xj56
- https://github.com/smithy-lang/smithy-rs/security/advisories/GHSA-8ffr-xgwf-xj56
- https://nvd.nist.gov/vuln/detail/CVE-2026-18140
- https://github.com/smithy-lang/smithy-rs/pull/4685
- https://github.com/smithy-lang/smithy-rs/commit/8f0882046c467981ba5b4fd91a10befa96bd262f
- https://aws.amazon.com/security/security-bulletins/2026-067-aws
- https://crates.io/crates/aws-smithy-json/0.62.7
- https://github.com/advisories/GHSA-8ffr-xgwf-xj56
- https://aws.amazon.com/security/security-bulletins/2026-067-aws/
Original description
Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which the smithy-rs code generator invokes from every generated struct deserializer, might allow remote unauthenticated users to cause a denial of service (process abort via stack exhaustion) via a single small HTTP request containing deeply nested JSON to a smithy-rs generated server. To remediate this issue, users should upgrade to aws-smithy-json 0.62.7 or later and rebuild.
Last activity 2 Oct 2026. Patch Forecast updates every hour.