CVE-2026-15957
Received Received - Intake

Denial of Service in Smithy-RS via Recursive Deserialization

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: AMZN

Description
Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations. Uncontrolled recursion in the JSON, CBOR, and XML deserializer functions emitted by Amazon smithy-rs code generation could allow remote attackers to cause a denial of service (process abort via stack exhaustion) via a small request containing deeply nested data for a recursive model shape to a generated SDK or server. To mitigate this issue, users should upgrade to aws-sdk-rust release-2026-06-02 or later. Users building custom servers with smithy-rs codegen should regenerate from smithy-rs release-2026-06-01 or later.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-21
Last Modified
2026-07-21
Generated
2026-07-22
AI Q&A
2026-07-21
EPSS Evaluated
N/A
NVD
CVE-2026-15957
EUVD
EUVD-2026-46386

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
amazon smithy-rs From 2026-06-01 (inc)
amazon aws-sdk-rust From 2026-06-02 (inc)
amazon smithy-rs to release-2026-06-02 (exc)
amazon aws_sdk_for_rust to release-2026-06-02 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an uncontrolled recursion flaw in the JSON, CBOR, and XML deserializer functions generated by Amazon smithy-rs. It allows remote attackers to cause a denial of service by sending a small request with deeply nested data for a recursive model shape, leading to stack exhaustion and process abort.

Detection Guidance

This vulnerability involves uncontrolled recursion in JSON, CBOR, and XML deserializers. Detection requires monitoring for stack exhaustion or process aborts during deserialization of deeply nested data. Check application logs for crashes or stack overflow errors when processing requests with recursive structures.

Impact Analysis

This vulnerability can cause your application to crash or become unresponsive if it processes malicious requests with deeply nested data. It affects both AWS SDK for Rust and custom servers built with smithy-rs code generation.

Compliance Impact

The vulnerability (CVE-2026-15957) enables denial-of-service attacks via stack exhaustion, which could disrupt services handling sensitive data. This may impact compliance with GDPR (availability requirements) and HIPAA (security and integrity of PHI) by causing service disruptions or data processing failures.

Mitigation Strategies

Upgrade to aws-sdk-rust release-2026-06-02 or later. If using custom servers with smithy-rs codegen, regenerate code from smithy-rs release-2026-06-01 or later. This addresses the uncontrolled recursion in deserializers causing stack exhaustion.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15957. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart