GHSA-8FFR-XGWF-XJ56 aws-smithy-json: Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers

Summary Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations. An issue exists which allows uncontrolled recursion in the unknown-key skip path of the...

acmer (>=0.0.1, <=0.0.4), auth-proxy (>=0.0.1, <=0.1.1) +463 more potentially affected by CVE-2026-18140 via aws-smithy-json (>=0.27.0-alpha.1, <=0.56.1)

aws-smithy-json CARGO version =0.27.0-alpha.1, =0.0.1, =0.0.1, =0.2.36, =0.0.18, =0.0.42, =0.0.1, =0.0.22-alpha, =0.0.1, =0.0.24, =0.0.1, =0.1.0, =0.0.22-alpha, =0.0.22-alpha, =0.0.22-alpha, =0.34.0 and more Source cves: CVE-2026-18140 Source advisory: OSV:GHSA-8FFR-XGWF-XJ56...

aws-smithy-json: Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers

Summary Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations. An issue exists which allows uncontrolled recursion in the unknown-key skip path of the...

EUVD-2026-51271

aws-smithy-json: Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers...

PT-2026-105496

Summary Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations. An issue exists which allows uncontrolled recursion in the unknown-key skip path of the...

aws-smithy-json: aws-smithy-json: Denial of Service via uncontrolled recursion with deeply nested JSON

A flaw was found in aws-smithy-json. This vulnerability allows a remote, unauthenticated attacker to cause a denial of service DoS in smithy-rs generated servers. By sending a small HTTP request containing deeply nested JSON, the attacker can trigger uncontrolled recursion in the aws-smithy-json...

Important: Red Hat Security Advisory: goose bug fix and enhancement update

An update for goose is now available for Red Hat Enterprise Linux 9. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Security Fixes: goose: aws-smithy-json: Denial of Service via uncontrolled...

aws-smithy-json: aws-smithy-json: Denial of Service via uncontrolled recursion with deeply nested JSON

A flaw was found in aws-smithy-json. This vulnerability allows a remote, unauthenticated attacker to cause a denial of service DoS in smithy-rs generated servers. By sending a small HTTP request containing deeply nested JSON, the attacker can trigger uncontrolled recursion in the aws-smithy-json...

Important: Red Hat Security Advisory: goose bug fix and enhancement update

An update for goose is now available for Red Hat Enterprise Linux 10. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Security Fixes: goose: aws-smithy-json: Denial of Service via uncontrolled...

RHEL 10 : goose update (Important) (RHSA-2026:67593)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:67593 advisory. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258...

RHEL 9 : goose update (Important) (RHSA-2026:67595)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:67595 advisory. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258...

CVE-2026-18140

A flaw was found in aws-smithy-json. This vulnerability allows a remote, unauthenticated attacker to cause a denial of service DoS in smithy-rs generated servers. By sending a small HTTP request containing deeply nested JSON, the attacker can trigger uncontrolled recursion in the aws-smithy-json...

Linux Distros Unpatched Vulnerability : CVE-2026-18140

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which the smithy-rs code generator invokes from every...

CVE-2026-18140

Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which the smithy-rs code generator invokes from every generated struct deserializer, might allow remote unauthenticated users to cause a denial of service process abort via stack exhaustion via...

CVE-2026-18140 Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers

Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which the smithy-rs code generator invokes from every generated struct deserializer, might allow remote unauthenticated users to cause a denial of service process abort via stack exhaustion via...

CVE-2026-18140

Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which the smithy-rs code generator invokes from every generated struct deserializer, might allow remote unauthenticated users to cause a denial of service process abort via stack exhaustion via...

CVE-2026-18140 Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers

Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which the smithy-rs code generator invokes from every generated struct deserializer, might allow remote unauthenticated users to cause a denial of service process abort via stack exhaustion via...

CVE-2026-18140: Uncontrolled Recursion

Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which the smithy-rs code generator invokes from every generated struct deserializer, might allow remote unauthenticated users to cause a denial of service process abort via stack exhaustion via...

PT-2026-66566

Name of the Vulnerable Software and Affected Versions aws-smithy-json versions prior to 0.62.7 Description Uncontrolled recursion occurs in the unknown-key skip path of the runtime crate, which is invoked by the smithy-rs code generator from every generated struct deserializer. This allows remote...

GHSA-JVXP-QMX7-GJPX Smithy-RS: Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service

Summary Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations. An issue exists where, under certain circumstances, allocation of resources without limits...