AWS patches uncontrolled recursion flaw in Smithy-Rs deserializers

Amazon Web Services published a security bulletin on July 21, 2026, addressing CVE-2026-15957, a vulnerability in the Smithy-Rs code generation framework. The flaw allows unauthenticated attackers to trigger a denial of service by sending small requests containing deeply nested data to applications using affected deserializers.

The issue stems from uncontrolled recursion in JSON, CBOR, and XML deserializer functions generated by Smithy-Rs. According to the advisory, an attacker can exploit recursive model shapes to cause a process abort via stack exhaustion. This affects both the AWS SDK for Rust and custom service implementations built on the framework.

Technical details and scope

Smithy-Rs is a Rust code generation and runtime framework that creates HTTP clients and servers from Smithy interface definitions. The vulnerability exists in the deserializer functions emitted by this code generation process. When these functions process data for recursive model shapes, they fail to limit recursion depth, leading to stack exhaustion.

AWS classified the bulletin as important, requiring attention from users of the framework. The advisory notes that the exploit requires only a small request containing the malicious nested structure. There is no authentication required to trigger the denial of service condition in affected generated SDKs or servers.

Who is affected

The vulnerability impacts aws-sdk-rust crates versions prior to release-2026-06-02. Any application or service using these older versions of the Rust SDK is potentially vulnerable to remote denial of service attacks. Custom service implementations that rely on Smithy-Rs for code generation are also within the scope of this advisory.

Users who have forked or derived code from the affected versions must ensure their custom implementations incorporate the new fixes. The advisory explicitly states that there is no workaround beyond updating to the patched versions. Organizations should audit their dependencies to identify any usage of vulnerable crate versions.

What should you do?

AWS has addressed the issue in release-2026-06-02. The company recommends upgrading to the latest version of the affected crates immediately. Users should verify that any forked or derivative code is patched to include the fixes provided in the new release.

Security teams should monitor for any signs of stack exhaustion or process aborts in services using the Rust SDK. Contact [email protected] with any security questions or concerns related to this bulletin. No temporary mitigation exists other than applying the software update.

What to do and how to stay safe

• Identify all instances of aws-sdk-rust crates in your development and production environments
• Verify that all instances are updated to release-2026-06-02 or later versions
• Review any forked or derivative code to ensure it incorporates the latest security fixes
• Monitor application logs for signs of

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.