Denial of Service via Missing Timeouts in aws-smithy-http-server <=0.66.4
CVE-2026-16756 Published on July 23, 2026
Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service
Missing connection and header-read timeouts and the absence of a concurrent-connection cap in the default serve() path of Amazon aws-smithy-http-server might allow remote attackers to cause a denial of service by opening many connections and sending partial requests that are never completed, exhausting server sockets and tasks.
To mitigate this issue, users should upgrade to aws-smithy-http-server 0.66.5 or later.
Vulnerability Analysis
CVE-2026-16756 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.
Weakness Type
Allocation of Resources Without Limits or Throttling
The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Products Associated with CVE-2026-16756
stack.watch emails you whenever new vulnerabilities are published in Aws Smithy Http Server or Amazon Aws. Just hit a watch button to start following.
Affected Versions
aws-smithy-http-server:- Before and including 0.66.4 is affected.