CVE-2025-18140: Uncontrolled recursion in aws-smithy-json allows remote DoS

Vulnerability Overview Title: Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers Description: CVSSv3.1 Rating: High CVSSv3.1 Score: 7.5 CVSSv3.1 Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Summary: Smithy-rs is a Rust code generation and runtime framework used to generate HTTP clients and servers. In the aws-smithy-json runtime library, there is an uncontrolled recursion issue that can lead to a remote denial of service attack. This issue affects Amazon's aws-smithy-json runtime library versions 0.62.6 and earlier. Impact: Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime library may allow a remote unauthenticated attacker to cause a denial of service (process abortion due to stack overflow) by sending a single small HTTP request containing deeply nested JSON to a smithy-rs-generated server. Affected Versions Affected Versions: aws-smithy-json <= 0.62.6 Fixed Versions: aws-smithy-json 0.62.7 Remediation Patches: This issue has been resolved in aws-smithy-json version 0.62.7. It is recommended to upgrade to the latest version and ensure that any derived code also applies the new fix. Workarounds: There are no workarounds other than upgrading to the fixed version. References If you have any questions or comments, please contact [AWS/Amazon] Security via the vulnerability reporting page or directly via email to aws-security@amazon.com. Do not create public GitHub issues. CVSS v3 Base Metrics Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High CVE ID CVE-2025-18140 Weaknesses No CWEs Code Block No POC code or exploit code is included on this page.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2025-18140: Uncontrolled recursion in aws-smithy-json allows remote DoS

More from this source