aws-smithy-json Uncontrolled Recursion Enables Remote DoS; Patch to 0.62.7 Required

AWS has released a fix for CVE-2026-18140, a vulnerability in the Smithy-RS framework that allows unauthenticated attackers to trigger a denial of service. The issue stems from uncontrolled recursion within the aws-smithy-json runtime crate, specifically in the path that skips unknown keys. This flaw impacts servers generated by the Smithy-RS code generator, which underpins the AWS SDK for Rust and various custom service implementations published by the vendor.

Root cause

The vulnerability arises because the aws-smithy-json crate fails to limit recursion depth when processing JSON data. According to the AWS security bulletin, the unknown-key skip path invokes a recursive call from every generated struct deserializer. An attacker can exploit this by sending a single HTTP request containing deeply nested JSON structures. This input forces the application to exhaust its stack memory, leading to a process abort and subsequent service disruption without requiring any form of authentication.

Attack path

An adversary needs only network access to a vulnerable Smithy-RS generated server to exploit this flaw. The attack vector is straightforward: the attacker sends a small HTTP request payload that includes JSON with extreme nesting levels. Because the parser does not validate or limit the depth of this nesting during the unknown-key skip operation, the server’s processing thread enters an infinite or excessive recursive loop. This results in immediate stack exhaustion and crashes the affected service process.

Affected versions

The vulnerability exists in all versions of the aws-smithy-json runtime crate prior to 0.62.7. Any application or service built using Smithy-RS code generation that relies on these earlier versions is exposed to the risk. The AWS SDK for Rust and custom implementations that utilise this framework are included in the scope of affected environments, as noted in the advisory published on 30 July 2026.

Mitigation

• Upgrade the aws-smithy-json crate to version 0.62.7 or later immediately.
• Verify that all forked or derivative code bases incorporate the fixes from the new release.
• Ensure that build pipelines and deployment configurations reference the patched version string.
• Confirm that no older versions remain in production or staging environments.

Signals worth monitoring

Teams usually detect this activity by observing sudden spikes in server resource usage followed by immediate process termination. Check application logs for rapid increases in stack depth warnings or unexpected crash dumps shortly after receiving HTTP requests. Monitor for a high volume of small, malformed JSON payloads targeting endpoints that handle arbitrary data structures. Look for patterns where service availability drops without corresponding increases in legitimate traffic volume. Investigate any instances where the server aborts unexpectedly during JSON deserialization tasks.

What to do and how to stay safe: AWS

• Audit your dependency tree to identify any usage of aws-smithy-json versions below 0.62.7.
• Review server access logs for recent HTTP requests containing deeply nested JSON payloads.
• Implement rate limiting on endpoints that accept unstructured JSON data to reduce exposure.
• Prepare an incident response plan for service restarts if stack exhaustion occurs before patching.

Step-by-step guide: Out-of-band patches: what small businesses need to know

General security guidance from the Firewall Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which CVE ID corresponds to this Smithy-RS vulnerability?

The vulnerability is tracked as CVE-2026-18140.

Is there a workaround for this issue?

No, the advisory states there is no workaround besides updating to the patched version.

What severity does AWS assign to this bulletin?

AWS classifies this bulletin as Important, requiring attention.