tag: smithy-rs

aws-smithy-json has a nasty uncontrolled recursion bug in its unknown-key skip path that lets unauthenticated attackers crash smithy-rs generated servers with a denial of service attack. This affects all servers built with the vulnerable library. You should patch immediately—no user interaction needed to trigger the exploit. Check AWS Security Bulletin for detailed mitigation steps and patched versions.

AWS smithy-rs has a nasty recursion vulnerability (CVE-2026-15957) in its JSON, CBOR, and XML deserializers that lets attackers crash your service with deeply nested payloads. If you're running aws-sdk-rust versions before release-2026-06-0, you need to patch immediately – this is a remote DoS that requires zero authentication. The fix is straightforward: upgrade your crates and you're golden.