CVE-2026-18140 - Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers
Smithy Rs ยท 2026-10-19
Actions
Technical Details
| Affected Versions | aws-smithy-json <= 0.62.6 |
|---|---|
| Regions | all |
| CVE IDs | CVE-2026-18140 |
| Migration Required | Yes |
| Cost Impact | Neutral |
| IaC Impact | High |
What This Means
For DevOps Teams
Update the aws-smithy-json runtime crate to version 0.62.7 to address the uncontrolled recursion vulnerability and prevent potential denial of service attacks.
For Platform Teams
Integrate the latest version of aws-smithy-json (0.62.7) into your platform to enhance security and prevent denial of service vulnerabilities.
For Executives
Implement the security patch for smithy-rs to mitigate the risk of denial of service attacks, ensuring the stability and reliability of your AWS infrastructure.