CVE-2026-16756
Received Received - Intake

Denial of Service in AWS Smithy HTTP Server

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: AMZN

Description
Missing connection and header-read timeouts and the absence of a concurrent-connection cap in the default serve() path of Amazon aws-smithy-http-server might allow remote attackers to cause a denial of service by opening many connections and sending partial requests that are never completed, exhausting server sockets and tasks. To mitigate this issue, users should upgrade to aws-smithy-http-server 0.66.5 or later.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-23
Last Modified
2026-07-23
Generated
2026-07-24
AI Q&A
2026-07-23
EPSS Evaluated
N/A
NVD
CVE-2026-16756
EUVD
EUVD-2026-48362

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
amazon aws-smithy-http-server From 0.66.5 (inc)
amazon aws-smithy-http-server to 0.66.4 (inc)
amazon aws-smithy-http-server 0.66.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a denial-of-service issue in the aws-smithy-http-server Rust framework. It occurs because the default serve() path lacks connection and header-read timeouts and a concurrent-connection cap. Attackers can exploit this by opening many connections and sending partial requests that are never completed, exhausting server resources.

Detection Guidance

Detecting this vulnerability requires checking the version of aws-smithy-http-server in use. Run commands like 'cargo tree -p aws-smithy-http-server' in your project directory or 'cargo install --list' to identify installed versions. If the version is 0.66.4 or earlier, the system is vulnerable.

Impact Analysis

This vulnerability allows remote attackers to cause a denial of service by exhausting server sockets and tasks. This can lead to service disruption, making the server unavailable to legitimate users. The impact is high severity due to its network-based nature and low complexity.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling denial-of-service attacks that disrupt service availability. GDPR requires data protection measures including availability controls, while HIPAA mandates safeguards against service disruptions. Exploits could lead to unauthorized resource exhaustion, potentially violating availability requirements.

Mitigation Strategies

Upgrade aws-smithy-http-server to version 0.66.5 or later immediately. This can be done via package managers like cargo or by updating dependencies in your project files. No workarounds exist besides applying this update.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16756. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart