Vulnerability Description
Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations. Uncontrolled recursion in the JSON, CBOR, and XML deserializer functions emitted by Amazon smithy-rs code generation could allow remote attackers to cause a denial of service (process abort via stack exhaustion) via a small request containing deeply nested data for a recursive model shape to a generated SDK or server. To mitigate this issue, users should upgrade to aws-sdk-rust release-2026-06-02 or later. Users building custom servers with smithy-rs codegen should regenerate from smithy-rs release-2026-06-01 or later.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://aws.amazon.com/security/security-bulletins/2026-061-aws/
- https://github.com/awslabs/aws-sdk-rust/releases/tag/release-2026-06-02
- https://github.com/smithy-lang/smithy-rs/security/advisories/GHSA-4f2p-7j38-4xrg
FAQ
What is CVE-2026-15957?
CVE-2026-15957 is a vulnerability with a CVSS score of 7.5 (HIGH). Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations. ...
How severe is CVE-2026-15957?
CVE-2026-15957 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-15957?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.