aws-smithy-json <=0.62.6 Recursion DoS via JSON payload
CVE-2026-18140 Published on July 30, 2026

Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers
Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which the smithy-rs code generator invokes from every generated struct deserializer, might allow remote unauthenticated users to cause a denial of service (process abort via stack exhaustion) via a single small HTTP request containing deeply nested JSON to a smithy-rs generated server. To remediate this issue, users should upgrade to aws-smithy-json 0.62.7 or later and rebuild.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-18140 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
NONE
Integrity Impact:
NONE
Availability Impact:
HIGH

Weakness Type

What is a Stack Exhaustion Vulnerability?

The product does not properly control the amount of recursion which takes place, consuming excessive resources, such as allocated memory or the program stack.

CVE-2026-18140 has been classified to as a Stack Exhaustion vulnerability or weakness.


Products Associated with CVE-2026-18140

stack.watch emails you whenever new vulnerabilities are published in Aws Smithy Json or Amazon Aws. Just hit a watch button to start following.

Aws Smithy Json
 
Amazon Aws
 

Affected Versions

aws-smithy-json: