CVE-2026-18140 - Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers

Smithy Rs ยท 2026-10-19

Actions

Rate this issue

Technical Details

Affected Versions aws-smithy-json <= 0.62.6
Regions all
CVE IDs CVE-2026-18140
Migration Required Yes
Cost Impact Neutral
IaC Impact High

What This Means

For DevOps Teams

Update the aws-smithy-json runtime crate to version 0.62.7 to address the uncontrolled recursion vulnerability and prevent potential denial of service attacks.

For Platform Teams

Integrate the latest version of aws-smithy-json (0.62.7) into your platform to enhance security and prevent denial of service vulnerabilities.

For Executives

Implement the security patch for smithy-rs to mitigate the risk of denial of service attacks, ensuring the stability and reliability of your AWS infrastructure.

Source

View original AWS announcement โ†’

Weekly AWS Digest in Your Inbox

No spam, no headlines. Just a weekly summary of the 3โ€“7 AWS changes that matter for DevOps and Platform teams.

๐Ÿ“ง Exactly 1 email per week โ€ข Every Tuesday โ€ข Unsubscribe anytime

Today: AWS only. Coming next: Azure and other major clouds.