Executive brief
AWS Smithy-rs is a code generator that creates AWS service clients and servers. An uncontrolled recursion vulnerability in its JSON parser allows unauthenticated attackers to send specially crafted requests that trigger excessive recursion, causing the affected service to crash or become unavailable. This can impact any AWS service or third-party service using Smithy-rs-generated servers.
Technical details
The vulnerability exists in the aws-smithy-json crate used by Smithy-rs generated servers, specifically in the code path that handles unknown keys during JSON deserialization. When processing JSON with deeply nested unknown keys, the recursive skip logic does not properly limit recursion depth, allowing an attacker to craft a malicious JSON payload that exhausts the call stack. No authentication is required; the vulnerability is triggered during request parsing before authentication checks occur. An attacker can send such a payload to any network-exposed Smithy-rs generated server endpoint, causing a denial of service. AWS has released patches to address the uncontrolled recursion in the skip path logic.
Affected products
- AWS Smithy-rs <unknown>
Timeline
- 2026-09-09: disclosed: CVE-2026-18140 published in AWS Security Bulletin
- 2026-09-09: other: Public advisory released with vulnerability details