Uncontrolled Recursion Vulnerability in AWS Smithy JSON Runtime Crate

CVE-2026-18140

What is CVE-2026-18140?

A vulnerability exists in the AWS Smithy JSON runtime crate prior to version 0.62.7, specifically in the unknown-key skip path, which may lead to uncontrolled recursion. When exploited, this vulnerability allows remote unauthenticated users to send a small HTTP request containing deeply nested JSON structures to a server generated by smithy-rs. This can result in a denial of service, causing the process to abort due to stack exhaustion. To mitigate this issue, it is critical for users to upgrade to aws-smithy-json version 0.62.7 or later and rebuild their applications.

References