CVE-2026-15957 in aws-sdk-rust
Summary
by MITRE • 07/21/2026
Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations.
Uncontrolled recursion in the JSON, CBOR, and XML deserializer functions emitted by Amazon smithy-rs code generation could allow remote attackers to cause a denial of service (process abort via stack exhaustion) via a small request containing deeply nested data for a recursive model shape to a generated SDK or server.
To mitigate this issue, users should upgrade to aws-sdk-rust release-2026-06-02 or later. Users building custom servers with smithy-rs codegen should regenerate from smithy-rs release-2026-06-01 or later.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/21/2026
The vulnerability in Smithy-RS represents a critical denial of service risk stemming from uncontrolled recursion in deserialization functions across JSON, CBOR, and XML parsers. This flaw affects the runtime framework that generates HTTP clients and servers from Smithy interface definitions, which serves as the foundation for the AWS SDK for Rust and custom service implementations. The vulnerability manifests when remote attackers craft malicious requests containing deeply nested data structures that correspond to recursive model shapes defined in Smithy specifications. These crafted inputs trigger infinite recursion during the deserialization process, leading to stack exhaustion and subsequent process termination.
The technical implementation of this vulnerability resides in the generated code that handles deserialization of structured data formats. When Smithy-RS processes interface definitions containing recursive model shapes, it generates deserializer functions that lack proper recursion depth checking mechanisms. This design flaw allows attackers to exploit the absence of safeguards by sending requests with nested data structures that exceed normal processing limits. The vulnerability impacts both client and server implementations generated by the framework, making it particularly dangerous for applications that process untrusted input from external sources.
From an operational perspective, this vulnerability creates significant risk for systems relying on Smithy-RS generated components, especially those handling external API requests or processing data from untrusted sources. The impact extends beyond simple service disruption to potentially compromising system availability and reliability in production environments. Organizations using AWS SDK for Rust or custom implementations built with smithy-rs code generation are particularly vulnerable since they inherit this recursion vulnerability in their generated code without explicit mitigation measures.
The mitigation strategy involves upgrading to specific release versions that address the recursion handling in deserializer functions. Users should upgrade to aws-sdk-rust release-2026-06-02 or later, while developers building custom servers with smithy-rs codegen must regenerate their components using smithy-rs release-2026-06-01 or later. This remediation approach addresses the root cause by implementing proper recursion depth limits and stack management within the generated deserialization logic. The vulnerability aligns with CWE-674 (Uncontrolled Recursion) and represents a specific instance of the broader class of denial of service attacks that exploit recursive data structures.
This issue demonstrates the importance of input validation and recursion protection in code generation frameworks, particularly when dealing with structured data formats that may contain nested or recursive elements. The vulnerability affects the ATT&CK technique T1499.004 (Endpoint Denial of Service) through process termination caused by stack exhaustion. Organizations should implement monitoring for unusual memory consumption patterns and establish proper input sanitization procedures when processing external data through Smithy-RS generated components, as the fix requires coordinated updates across multiple software layers to achieve complete protection against this class of denial of service attacks.