CVE-2026-15957

Uncontrolled recursion in smithy-rs generated JSON, CBOR, and XML deserializers allows unauthenticated remote denial of service via recursive shapes

State: Published
Severity: 8.7 High
Published: Jul 21, 2026
Updated: Oct 20, 2026
Reserved: Jul 16, 2026

Read the record on cve.org

Description

Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations.

Uncontrolled recursion in the JSON, CBOR, and XML deserializer functions emitted by Amazon smithy-rs code generation could allow remote attackers to cause a denial of service (process abort via stack exhaustion) via a small request containing deeply nested data for a recursive model shape to a generated SDK or server.

To mitigate this issue, users should upgrade to aws-sdk-rust release-2026-06-02 or later. Users building custom servers with smithy-rs codegen should regenerate from smithy-rs release-2026-06-01 or later.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N	AMZN
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	AMZN

Weaknesses

CWE-674 Uncontrolled Recursion (Stack Exhaustion)

Affected Products

Product	Versions
aws-sdk-rustAWS	before release-2026-06-02Affected

References

https://github.com/awslabs/aws-sdk-rust/releases/tag/release-2026-06-02release-notespatch
https://aws.amazon.com/security/security-bulletins/2026-061-aws/vendor-advisory
https://github.com/smithy-lang/smithy-rs/security/advisories/GHSA-4f2p-7j38-4xrgrelease-notes

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.