{"uuid": "abbe36d9-9980-487b-b8b9-0a5e2e7c32df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-8ffr-xgwf-xj56", "type": "seen", "source": "https://gist.github.com/alon710/5749b97520bb81c62a30e2ec8149d3bb", "content": "# CVE-2026-18140: CVE-2026-18140: Uncontrolled Recursion in aws-smithy-json Token Skipping Path\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-10-02\n> **Full Report:** https://cvereports.com/reports/CVE-2026-18140\n\n## Summary\nCVE-2026-18140 is a denial-of-service vulnerability in the Amazon aws-smithy-json Rust crate. Under-validation of recursion depth within the unknown-key skipping path allows a remote, unauthenticated attacker to cause stack exhaustion and process aborts by sending deeply nested JSON arrays.\n\n## TL;DR\nA stack overflow vulnerability in the aws-smithy-json token-skipping function allows unauthenticated remote attackers to crash Smithy-rs generated servers via deeply nested JSON payloads.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **Vulnerability Type**: Uncontrolled Recursion (CWE-674)\n- **Impact**: Denial of Service (Process Abort)\n- **CVSS v3.1 Score**: 7.5 (High)\n- **EPSS Score**: 0.00431 (Percentile: 35.02%)\n- **Exploit Status**: Proof of Concept Only\n- **CISA KEV Status**: Not Listed\n- **Affected Components**: rust-runtime/aws-smithy-json/src/deserialize/token.rs\n\n## Affected Systems\n\n- aws-smithy-json Rust runtime crate\n- smithy-rs framework generated servers\n- **aws-smithy-json**: >= 0.32.0, <= 0.62.6 (Fixed in: `0.62.7`)\n\n## Mitigation\n\n- Update the aws-smithy-json dependency in your Cargo lock file to version 0.62.7 or higher.\n- Limit payload sizes at the reverse proxy or Web Application Firewall (WAF) layer.\n- Inspect incoming JSON arrays to block excessive consecutive nesting syntax (such as repeating brackets).\n\n**Remediation Steps:**\n1. Navigate to the project directory containing your Cargo.toml file.\n2. Run 'cargo update -p aws-smithy-json' to fetch the latest non-vulnerable version.\n3. Verify the Cargo.lock file ensures aws-smithy-json resolves to version 0.62.7 or higher.\n4. Recompile your application using 'cargo build --release' to embed the updated parsing logic.\n5. Deploy the patched executable into production environments.\n\n## References\n\n- [Patch Commit: Convert skip_inner to Iterative Pattern](https://github.com/smithy-lang/smithy-rs/commit/8f0882046c467981ba5b4fd91a10befa96bd262f)\n- [GitHub PR #4685: Replace Recursion with Iterative Model](https://github.com/smithy-lang/smithy-rs/pull/4685)\n- [AWS Security Bulletin 2026-067-aws](https://aws.amazon.com/security/security-bulletins/2026-067-aws/)\n- [GitHub Security Advisory GHSA-8ffr-xgwf-xj56](https://github.com/smithy-lang/smithy-rs/security/advisories/GHSA-8ffr-xgwf-xj56)\n- [Crates.io Package Release: aws-smithy-json 0.62.7](https://crates.io/crates/aws-smithy-json/0.62.7)\n- [NVD - CVE-2026-18140 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-18140)\n- [Wiz Vulnerability Database Profile](https://www.wiz.io/vulnerability-database/cve/cve-2026-18140)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-18140) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-03T12:30:31.000000Z"}