CVE-2026-18140: aws-smithy-json: Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers
Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations. An issue exists which allows uncontrolled recursion in the unknown-key skip path of the Amazon aws-smithy-json runtime crate in versions 0.62.6 and earlier.
References
- aws.amazon.com/security/security-bulletins/2026-067-aws
- crates.io/crates/aws-smithy-json/0.62.7
- github.com/advisories/GHSA-8ffr-xgwf-xj56
- github.com/smithy-lang/smithy-rs/commit/8f0882046c467981ba5b4fd91a10befa96bd262f
- github.com/smithy-lang/smithy-rs/pull/4685
- github.com/smithy-lang/smithy-rs/security/advisories/GHSA-8ffr-xgwf-xj56
- nvd.nist.gov/vuln/detail/CVE-2026-18140
Code Behaviors & Features
Detect and mitigate CVE-2026-18140 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →