CVE-2026-18140: Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers
Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which the smithy-rs code generator invokes from every generated struct deserializer, might allow remote unauthenticated users to cause a denial of service (process abort via stack exhaustion) via a single small HTTP request containing deeply nested JSON to a smithy-rs generated server.
To remediate this issue, users should upgrade to aws-smithy-json 0.62.7 or later and rebuild.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
aws-smithy-jsonto a version that resolves this vulnerability.Fixed in 0.62.7 - Operational
After upgrading to aws-smithy-json 0.62.7 or later, rebuild the smithy-rs generated servers so the generated struct deserializers use the fixed aws-smithy-json runtime crate.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18140?
CVE-2026-18140 has a high severity rating of 7.5.
How do I fix CVE-2026-18140?
To fix CVE-2026-18140, update the aws-smithy-json crate to version 0.62.7 or later.
What type of attack does CVE-2026-18140 allow?
CVE-2026-18140 allows unauthenticated remote denial of service via uncontrolled recursion.
Which software components are affected by CVE-2026-18140?
The affected components include aws-smithy-json and aws-smithy-rs generated servers.
When was CVE-2026-18140 published?
CVE-2026-18140 was published on July 30, 2026.