CVE-2026-18140CWE-674

CVE-2026-18140

High · published July 30, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
36.2
In the wild
Unconfirmed
What it is

Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which the smithy-rs code generator invokes from every generated struct deserializer, might allow remote unauthenticated users to cause a denial of service (process abort via stack exhaustion) via a single small HTTP request containing deeply nested JSON to a smithy-rs generated server.

To remediate this issue, users should upgrade to aws-smithy-json 0.62.7 or later and rebuild.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00431 · 36.2th percentile
Weakness
CWE-674 · Uncontrolled Recursion
Published
2026-07-30T23:17Z
Affected products (1)
ProductVersionsFixed in
amazon/aws-smithy-json< 0.62.70.62.7
References (3)
https://aws.amazon.com/security/security-bulletins/2026-067-aws/ · ff89ba41-3aa1-4d27-914a-91399e9639e5https://crates.io/crates/aws-smithy-json/0.62.7 · ff89ba41-3aa1-4d27-914a-91399e9639e5https://github.com/smithy-lang/smithy-rs/security/advisories/GHSA-8ffr-xgwf-xj56 · ff89ba41-3aa1-4d27-914a-91399e9639e5
EPSS history
Timeline
  • 30 JUL 18:34Z
    Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers
    cvelistv5