aws-smithy-json has a nasty uncontrolled recursion bug in its unknown-key skip path that lets unauthenticated attackers crash smithy-rs generated servers with a denial of service attack. This affects all servers built with the vulnerable library. You should patch immediately—no user interaction needed to trigger the exploit. Check AWS Security Bulletin for detailed mitigation steps and patched versions.
aws-smithy-http-server versions 0.66.4 and earlier have a nasty vulnerability (CVE-2026-16756) that lets unauthenticated attackers launch Slowloris denial of service attacks. The issue? Unlimited resource allocation in the default serve() path means attackers can tie up your server without breaking a sweat. If you're running Smithy-RS for the AWS SDK for Rust or custom services, update immediately to patch this.
AWS smithy-rs has a nasty recursion vulnerability (CVE-2026-15957) in its JSON, CBOR, and XML deserializers that lets attackers crash your service with deeply nested payloads. If you're running aws-sdk-rust versions before release-2026-06-0, you need to patch immediately – this is a remote DoS that requires zero authentication. The fix is straightforward: upgrade your crates and you're golden.