AWS Fixes Unauthenticated Slowloris DoS Flaw in Smithy-RS HTTP Server

AWS published a security bulletin on July 23, 2026, addressing a denial-of-service vulnerability in its Smithy-RS framework. The company released version 0.66.5 of aws-smithy-http-server to fix CVE-2026-16756, which allowed attackers to exhaust server resources without authentication. This update resolves a flaw in the default serve() path that failed to limit resource allocation.

The vulnerability, tracked as CVE-2026-16756, affects aws-smithy-http-server versions 0.66.4 and earlier. According to the AWS Security Bulletins advisory, the lack of resource limits in the default server path permits unauthenticated Slowloris attacks. These attacks can cause denial-of-service conditions by keeping connections open and consuming server resources indefinitely. AWS classified the bulletin as important and requiring attention.

Context and Background

Smithy-RS is a Rust code generation and runtime framework used to create HTTP clients and servers from Smithy interface definitions. It powers the AWS SDK for Rust and supports custom service implementations built by developers. The framework generates the underlying code that handles HTTP requests and responses for services using Smithy definitions.

AWS discovered the issue through its coordinated vulnerability disclosure process. The company credited independent security researcher Lav Kumar Vishwakarma for reporting the flaw. AWS thanked the researcher for identifying the resource allocation gap in the default server configuration. The disclosure highlights the importance of external research in securing open-source components used in cloud infrastructure.

Who Is Affected

Developers using aws-smithy-http-server version 0.66.4 or any earlier release are impacted by this vulnerability. The flaw exists in the default serve() path, meaning applications that use the standard configuration without additional resource limiting controls are exposed. Custom service implementations that rely on Smithy-RS for HTTP handling are also at risk if they have not upgraded.

AWS states that there is no workaround for this issue other than upgrading to version 0.66.5. Users must ensure that any forked or derivative code is patched to incorporate the new fixes. Organizations relying on the AWS SDK for Rust should verify their dependency versions to confirm they are not running vulnerable builds.

What should you do?

Security teams should immediately check their systems for aws-smithy-http-server versions 0.66.4 and below. If vulnerable versions are detected, upgrade to version 0.66.5 or later as soon as possible. Review any custom forks of the library to ensure the patch is applied. Monitor server logs for signs of Slowloris-style connection exhaustion, such as unusually long-lived idle connections.

Background: Coordinated vulnerability disclosure

Coordinated vulnerability disclosure reveals software flaws to vendors before public release. Small teams must patch during this quiet period. Monitor vendor security pages, prioritize critical updates, and verify that your IT provider tracks these disclosures to prevent exploitation of known weaknesses before public patches arrive.

Read the full guide: Coordinated Vulnerability Disclosure for Small Teams

What to do and how to stay safe: AWS

• Audit your dependency tree to identify any instances of aws-smithy-http-server version 0.66.4 or earlier.
• Upgrade to aws-smithy-http-server version 0.66.5 or the latest available release to apply the fix.
• Verify that any forked or modified versions of the library include the resource-limiting patches from the official update.
• Monitor server metrics for abnormal connection counts or idle timeout patterns indicative of Slowloris attacks.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-16756?

CVE-2026-16756 is a vulnerability in aws-smithy-http-server versions up to 0.66.4 that allows unauthenticated Slowloris denial-of-service attacks due to unlimited resource allocation in the default serve() path.

Is there a workaround for this vulnerability?

No, AWS states there is no workaround besides upgrading to the patched version 0.66.5 or later.

Who discovered this vulnerability?

Independent security researcher Lav Kumar Vishwakarma discovered the issue and reported it through the coordinated vulnerability disclosure process.