Executive brief
AWS Smithy HTTP Server is a networking component used by AWS services and applications built on Smithy-based APIs to handle incoming HTTP requests. An unauthenticated attacker can launch a Slowloris denial-of-service attack against servers using the default configuration, sending slow/incomplete HTTP requests to exhaust server resources and making the service unavailable to legitimate users.
Technical details
This vulnerability exists in the default aws-smithy-http-server serve() path due to lack of resource allocation limits (CWE-770). The HTTP server does not impose timeouts, connection limits, or request size restrictions on the default endpoint, allowing a Slowloris attack where an unauthenticated attacker sends slow or incomplete HTTP requests to keep connections open and exhaust server resources. This is a network-reachable vulnerability requiring no authentication or user interaction. An attacker can achieve denial of service by preventing legitimate requests from being processed. Patches are available and should be applied to remediate the issue.
Affected products
- AWS Smithy HTTP Server <UNKNOWN>
Timeline
- 2026-09-22: disclosed