CVE-2026-18140

Awaiting Analysis Awaiting Analysis - Queue

Denial of Service in aws-smithy-json via JSON Recursion

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: AMZN

Description

Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which the smithy-rs code generator invokes from every generated struct deserializer, might allow remote unauthenticated users to cause a denial of service (process abort via stack exhaustion) via a single small HTTP request containing deeply nested JSON to a smithy-rs generated server. To remediate this issue, users should upgrade to aws-smithy-json 0.62.7 or later and rebuild.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-30

Generated

2026-07-31

AI Q&A

2026-07-31

EPSS Evaluated

N/A

NVD

CVE-2026-18140

EUVD

EUVD-2026-51271

Affected Vendors & Products

Vendor	Product	Version / Range
aws	aws-smithy-json	From 0.62.7 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-674	The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

Executive Summary

This vulnerability involves uncontrolled recursion in the aws-smithy-json runtime crate before version 0.62.7. When processing deeply nested JSON data, the system may experience stack exhaustion leading to a denial of service (process abort). This occurs because the smithy-rs code generator invokes the vulnerable path from every generated struct deserializer.

Detection Guidance

This vulnerability may be detected by monitoring for stack exhaustion or process aborts when processing deeply nested JSON requests. Check server logs for crashes or stack overflow errors during JSON parsing. Use tools like tcpdump or Wireshark to inspect incoming HTTP requests for unusually deep JSON nesting.

Impact Analysis

An attacker could send a single small HTTP request containing deeply nested JSON to a vulnerable server. This would cause the server to crash due to stack exhaustion, resulting in a denial of service. The impact includes service unavailability and potential downtime for applications relying on the affected aws-smithy-json crate.

Compliance Impact

This vulnerability could lead to service disruptions, which may violate availability requirements in GDPR and HIPAA. Downtime could result in unauthorized access to data or failure to provide timely access to personal health information, potentially breaching compliance obligations.

Mitigation Strategies

Upgrade the aws-smithy-json library to version 0.62.7 or later and rebuild all affected applications. Ensure all smithy-rs generated servers are updated to use the patched runtime. Monitor systems for signs of exploitation or crashes.

Hi! I’m here to help you understand CVE-2026-18140. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70