CVE-2026-15957: Uncontrolled recursion in smithy-rs generated JSON, CBOR, and XML deserializers allows unauthenticated remote denial of service via recursive shapes
Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations.
Uncontrolled recursion in the JSON, CBOR, and XML deserializer functions emitted by Amazon smithy-rs code generation could allow remote attackers to cause a denial of service (process abort via stack exhaustion) via a small request containing deeply nested data for a recursive model shape to a generated SDK or server.
To mitigate this issue, users should upgrade to aws-sdk-rust release-2026-06-02 or later. Users building custom servers with smithy-rs codegen should regenerate from smithy-rs release-2026-06-01 or later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
aws-sdk-rustto a version that resolves this vulnerability.Fixed in release-2026-06-02 - Upgrade
Upgrade
smithy-rs codegento a version that resolves this vulnerability.Fixed in release-2026-06-01
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15957?
The severity of CVE-2026-15957 is rated high with a score of 7.5.
How do I fix CVE-2026-15957?
To fix CVE-2026-15957, regenerate your code using the latest version of the Amazon smithy-rs framework.
What is CVE-2026-15957?
CVE-2026-15957 is a vulnerability that allows unauthenticated remote denial of service due to uncontrolled recursion in deserializer functions.
What software is affected by CVE-2026-15957?
CVE-2026-15957 affects the Amazon smithy-rs framework and the Amazon aws-sdk-rust implementation.
Can CVE-2026-15957 be exploited remotely?
Yes, CVE-2026-15957 can be exploited remotely due to its nature of allowing unauthenticated denial of service.