{"vulnerability": "CVE-2026-16756", "sightings": [{"uuid": "0fd3e06f-807e-4bf8-ae3e-d36f374af865", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16756", "type": "seen", "source": "https://bsky.app/profile/rindrics.com/post/3mre5olrots2j", "content": "FYI @amazonwebservices.bsky.social \nThe title of the \u2018card view\u2019 entry for CVE-2026-16756 in the Security Bulletin has been incorrectly listed as that for CVE-2026-16584.\naws.amazon.com/security/sec...", "creation_timestamp": "2026-07-24T01:01:22.206747Z"}, {"uuid": "6fdfabf9-be33-4e4f-8364-f91de328ab32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16756", "type": "seen", "source": "https://gist.github.com/alon710/5da01f85fee825f05b5c606f0085a6c9", "content": "# CVE-2026-16756: CVE-2026-16756: Slowloris Denial of Service via Resource Exhaustion in aws-smithy-http-server\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-07-24\n> **Full Report:** https://cvereports.com/reports/CVE-2026-16756\n\n## Summary\nAn unauthenticated remote resource exhaustion vulnerability in Amazon aws-smithy-http-server enables denial-of-service (DoS) attacks. Affected versions do not enforce connection limits or header timeouts, allowing standard Slowloris techniques to block server operations.\n\n## TL;DR\nUnauthenticated attackers can exhaust server connections and task buffers in Amazon aws-smithy-http-server by maintaining slow, partial HTTP request streams, leading to a complete denial-of-service condition.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-770 (Allocation of Resources Without Limits or Throttling)\n- **Attack Vector**: Network\n- **CVSS**: 7.5 (High)\n- **EPSS Score**: 0.00417 (34.15th Percentile)\n- **Impact**: Denial of Service (DoS) via resource exhaustion\n- **Exploit Status**: Proof-of-Concept / Theoretical\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- AWS Smithy Runtime Systems\n- Rust Microservices utilizing smithy-rs server generation\n- Deployments running stand-alone aws-smithy-http-server binaries\n- **aws-smithy-http-server**: <= 0.66.4 (Fixed in: `0.66.5`)\n\n## Mitigation\n\n- Upgrade the aws-smithy-http-server library dependency to version 0.66.5 or later.\n- Place a dedicated reverse proxy (NGINX, HAProxy) or Application Load Balancer in front of the application.\n- Apply localized connection limits and header timeouts using custom Tower or Tokio middleware stack configurations.\n\n**Remediation Steps:**\n1. Open Cargo.toml within the Rust workspace containing the Smithy server logic.\n2. Update the dependency version of `aws-smithy-http-server` to `\"0.66.5\"` or newer.\n3. Run cargo update to download the patched crate version and rebuild the application binary.\n4. Validate the fix locally by setting a low connection timeout and observing server response to incomplete headers.\n\n## References\n\n- [AWS Security Bulletin](https://aws.amazon.com/security/security-bulletins/2026-064-aws/)\n- [Crates.io Release Page](https://crates.io/crates/aws-smithy-http-server/0.66.5)\n- [GitHub Security Advisory (GHSA)](https://github.com/smithy-lang/smithy-rs/security/advisories/GHSA-jvxp-qmx7-gjpx)\n- [Official CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-16756)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-16756) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-25T04:31:18.047938Z"}]}