smithy-rs/Rust SDK Deserializer Uncontrolled Recursion DoS (CVE-2026-15967)

Vulnerability Overview Title: Uncontrolled recursion in smithy-rs generated JSON, CBOR, and XML deserializers allows unauthenticated remote denial of service via recursive shapes Description: smithy-rs is a Rust code generation and runtime framework used for generating HTTP interface definitions, the AWS SDK for Rust, and custom service implementations. In certain scenarios, the JSON, CBOR, and XML deserializers generated by smithy-rs allow unauthenticated remote denial-of-service attacks via recursive shapes. Impact: An attacker can cause a stack overflow in the recursive model by sending requests containing deeply nested data, resulting in a denial of service. Affected Versions Affected Versions: = release-2026-06-02 Affected Packages: aws-sdk-rust crates Remediation Patch: This issue has been fixed in the aws-sdk-rust crates version release-2026-06-02. It is recommended to upgrade to the latest version and ensure that all derived code is also patched accordingly. Workaround: There are no workarounds other than updating to the fixed version. References For further inquiries or comments, contact AWS Security via the vulnerability reporting page or by sending an email to aws-security@amazon.com. Do not create public GitHub issues. CVSS v3 Base Metrics Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High CVE ID CVE-2026-15967 Weakness No CWEs --- Summary: This vulnerability involves uncontrolled recursion in the JSON, CBOR, and XML deserializers generated by smithy-rs, which may lead to a remote denial-of-service attack. Affected versions need to be upgraded to release-2026-06-02 or later to fix this issue.

Goal Reached Thanks to every supporter — we hit 100%!

smithy-rs/Rust SDK Deserializer Uncontrolled Recursion DoS (CVE-2026-15967)

More from this source