CVE-2026-16756CWE-770denial-of-service

CVE-2026-16756

High · published July 23, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
54.4
In the wild
Unconfirmed
What it is

Missing connection and header-read timeouts and the absence of a concurrent-connection cap in the default serve() path of Amazon aws-smithy-http-server might allow remote attackers to cause a denial of service by opening many connections and sending partial requests that are never completed, exhausting server sockets and tasks.

To mitigate this issue, users should upgrade to aws-smithy-http-server 0.66.5 or later.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00750 · 54.4th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-07-23T23:16Z
References (3)
https://aws.amazon.com/security/security-bulletins/2026-064-aws/ · ff89ba41-3aa1-4d27-914a-91399e9639e5https://crates.io/crates/aws-smithy-http-server/0.66.5 · ff89ba41-3aa1-4d27-914a-91399e9639e5https://github.com/smithy-lang/smithy-rs/security/advisories/GHSA-jvxp-qmx7-gjpx · ff89ba41-3aa1-4d27-914a-91399e9639e5
EPSS history
Timeline
  • 23 JUL 18:32Z
    Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service
    cvelistv5