AWS Fixes Remote DoS Flaw in Smithy-RS JSON Parser

Amazon Web Services published a security bulletin on July 30, 2026, addressing a denial-of-service vulnerability in its Smithy-RS framework. The issue, tracked as CVE-2026-18140, allows unauthenticated remote attackers to crash servers by sending specifically crafted JSON data.

The flaw resides in the aws-smithy-json runtime crate, specifically within the unknown-key skip path. AWS identified that this component uses uncontrolled recursion when processing deeply nested JSON structures. This behavior can lead to stack exhaustion, resulting in a process abort.

Technical Context

Smithy-RS is a Rust code generation and runtime framework. It generates HTTP clients and servers from Smithy interface definitions. This framework powers the AWS SDK for Rust as well as custom service implementations built by developers using the toolset.

The vulnerability exists in versions of aws-smithy-json before 0.62.7. The smithy-rs code generator invokes the problematic deserializer from every generated struct deserializer. This means the flaw is present in the core logic that handles JSON parsing for many generated server components.

An attacker does not need authentication to exploit this issue. A single small HTTP request containing deeply nested JSON is sufficient to trigger the recursion. The resulting stack exhaustion causes the server process to abort, leading to a denial of service.

Who Is Affected

Any server generated using smithy-rs with an affected version of aws-smithy-json is vulnerable. This includes services built with the AWS SDK for Rust if they rely on the older runtime crate. Custom service implementations that use the smithy-rs code generator are also at risk.

Developers who have forked or created derivative code based on the original smithy-rs framework may also be affected. AWS notes that such custom code must be patched to incorporate the new fixes found in the official release.

The bulletin classifies the issue as "Important," indicating it requires attention. There is no workaround besides updating to the patched version. Users cannot mitigate the risk through configuration changes or external controls.

What should you do?

AWS recommends upgrading to aws-smithy-json version 0.62.7 or later. This version addresses the uncontrolled recursion issue in the unknown-key skip path. Organizations should ensure that all generated servers are rebuilt with the updated dependencies.

Developers using forked versions of the framework should apply the fixes manually. AWS advises checking for any derivative code that might still contain the vulnerable recursion logic. Contact [email protected] for security questions or concerns related to this bulletin.

What to do and how to stay safe: AWS

• Audit your server dependencies to identify if you are using aws-smithy-json versions prior to 0.62.7.
• Update your Rust projects to include the patched version of the aws-smithy-json runtime crate.
• Rebuild any servers generated with smithy-rs to ensure they incorporate the latest security fixes.
• Monitor server logs for unexpected process aborts or stack overflow errors that might indicate exploitation.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-18140?

It is a vulnerability in aws-smithy-json before version 0.62.7 that allows unauthenticated remote denial of service via stack exhaustion.

Which versions are affected?

All versions of aws-smithy-json before 0.62.7 are affected.

Is there a workaround?

No, AWS states there is no workaround besides updating to the patched version.