Vulnerability-Lookup

CVE-2026-18140 (GCVE-0-2026-18140)

Vulnerability from cvelistv5 – Published: 2026-07-30 18:34 – Updated: 2026-07-30 19:12

Title

Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers

Summary

Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which the smithy-rs code generator invokes from every generated struct deserializer, might allow remote unauthenticated users to cause a denial of service (process abort via stack exhaustion) via a single small HTTP request containing deeply nested JSON to a smithy-rs generated server. To remediate this issue, users should upgrade to aws-smithy-json 0.62.7 or later and rebuild.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-30 19:12 UTC

CWE

CWE-674 - Uncontrolled Recursion

Assigner

AMZN CNA under the mitre root

CNA scorecard A 94/100 over 164 records in the last 180 days details

References

3 references

URL	Tags
https://crates.io/crates/aws-smithy-json/0.62.7	patch
https://aws.amazon.com/security/security-bulletin…	vendor-advisory
https://github.com/smithy-lang/smithy-rs/security…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version	CPE status
AWS	aws-smithy-json	Affected: 0.32.0 , ≤ 0.62.6 (custom) cpe:2.3:a:aws:aws-smithy-json::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-18140",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-30T19:12:34.733029Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-30T19:12:50.560Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "aws-smithy-json",
          "vendor": "AWS",
          "versions": [
            {
              "lessThanOrEqual": "0.62.6",
              "status": "affected",
              "version": "0.32.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:aws:aws-smithy-json:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "0.62.6",
                  "versionStartIncluding": "0.32.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which the smithy-rs code generator invokes from every generated struct deserializer, might allow remote unauthenticated users to cause a denial of service (process abort via stack exhaustion) via a single small HTTP request containing deeply nested JSON to a smithy-rs generated server.\u003c/p\u003e\u003cp\u003eTo remediate this issue, users should upgrade to aws-smithy-json 0.62.7 or later and rebuild.\u003c/p\u003e"
            }
          ],
          "value": "Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which the smithy-rs code generator invokes from every generated struct deserializer, might allow remote unauthenticated users to cause a denial of service (process abort via stack exhaustion) via a single small HTTP request containing deeply nested JSON to a smithy-rs generated server.\n\n\n\nTo remediate this issue, users should upgrade to aws-smithy-json 0.62.7 or later and rebuild."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-230",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-230: Serialized Data with Nested Payloads"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674: Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-30T18:34:04.099Z",
        "orgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
        "shortName": "AMZN"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://crates.io/crates/aws-smithy-json/0.62.7"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://aws.amazon.com/security/security-bulletins/2026-067-aws/"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://github.com/smithy-lang/smithy-rs/security/advisories/GHSA-8ffr-xgwf-xj56"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
    "assignerShortName": "AMZN",
    "cveId": "CVE-2026-18140",
    "datePublished": "2026-07-30T18:34:04.099Z",
    "dateReserved": "2026-07-28T18:30:40.451Z",
    "dateUpdated": "2026-07-30T19:12:50.560Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-18140",
      "date": "2026-11-13",
      "epss": "0.00784",
      "percentile": "0.56602"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "aws-smithy-json",
                "vendor": "AWS",
                "versions": [
                  {
                    "lessThanOrEqual": "0.62.6",
                    "status": "affected",
                    "version": "0.32.0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:amazon:aws-smithy-json:*:*:*:*:*:rust:*:*",
                    "matchCriteriaId": "BDC78F08-F0CF-4631-931C-7C24AB4257FC",
                    "versionEndExcluding": "0.62.7",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which the smithy-rs code generator invokes from every generated struct deserializer, might allow remote unauthenticated users to cause a denial of service (process abort via stack exhaustion) via a single small HTTP request containing deeply nested JSON to a smithy-rs generated server.\n\n\n\nTo remediate this issue, users should upgrade to aws-smithy-json 0.62.7 or later and rebuild."
          },
          {
            "lang": "es",
            "value": "Recursi\u00f3n incontrolada en la ruta de omisi\u00f3n de clave desconocida del crate de tiempo de ejecuci\u00f3n aws-smithy-json anterior a 0.62.7, que el generador de c\u00f3digo smithy-rs invoca desde cada deserializador de estructura generado, podr\u00eda permitir a usuarios remotos no autenticados causar una denegaci\u00f3n de servicio (aborto de proceso por agotamiento de pila) a trav\u00e9s de una \u00fanica peque\u00f1a solicitud HTTP que contiene JSON profundamente anidado a un servidor generado por smithy-rs.\n\nPara remediar este problema, los usuarios deber\u00edan actualizar a aws-smithy-json 0.62.7 o posterior y reconstruir."
          }
        ],
        "id": "CVE-2026-18140",
        "lastModified": "2026-10-23T22:10:00.160",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
              "type": "Secondary"
            }
          ],
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 8.7,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-18140",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-30T19:12:34.733029Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-07-30T19:17:26.457",
        "references": [
          {
            "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://aws.amazon.com/security/security-bulletins/2026-067-aws/"
          },
          {
            "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
            "tags": [
              "Product"
            ],
            "url": "https://crates.io/crates/aws-smithy-json/0.62.7"
          },
          {
            "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://github.com/smithy-lang/smithy-rs/security/advisories/GHSA-8ffr-xgwf-xj56"
          }
        ],
        "sourceIdentifier": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-674"
              }
            ],
            "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-11-04T22:10:24+00:00",
      "cve": "CVE-2026-18140",
      "id": "CVE-2026-18140",
      "initial_release_date": "2026-07-30T18:34:04.099000+00:00",
      "product_status:fixed": "47",
      "product_status:known_affected": "1",
      "product_status:known_not_affected": "122",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "aws-smithy-json: aws-smithy-json: Denial of Service via uncontrolled recursion with deeply nested JSON",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-18140.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-18140",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-30T19:12:34.733029Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-30T19:12:45.317Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "aws-smithy-json",
              "vendor": "AWS",
              "versions": [
                {
                  "lessThanOrEqual": "0.62.6",
                  "status": "affected",
                  "version": "0.32.0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:a:aws:aws-smithy-json:*:*:*:*:*:*:*:*",
                      "versionEndIncluding": "0.62.6",
                      "versionStartIncluding": "0.32.0",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ],
              "operator": "OR"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eUncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which the smithy-rs code generator invokes from every generated struct deserializer, might allow remote unauthenticated users to cause a denial of service (process abort via stack exhaustion) via a single small HTTP request containing deeply nested JSON to a smithy-rs generated server.\u003c/p\u003e\u003cp\u003eTo remediate this issue, users should upgrade to aws-smithy-json 0.62.7 or later and rebuild.\u003c/p\u003e"
                }
              ],
              "value": "Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which the smithy-rs code generator invokes from every generated struct deserializer, might allow remote unauthenticated users to cause a denial of service (process abort via stack exhaustion) via a single small HTTP request containing deeply nested JSON to a smithy-rs generated server.\n\n\n\nTo remediate this issue, users should upgrade to aws-smithy-json 0.62.7 or later and rebuild."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-230",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-230: Serialized Data with Nested Payloads"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            },
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 8.7,
                "baseSeverity": "HIGH",
                "exploitMaturity": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-674",
                  "description": "CWE-674: Uncontrolled Recursion",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-30T18:34:04.099Z",
            "orgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
            "shortName": "AMZN"
          },
          "references": [
            {
              "tags": [
                "patch"
              ],
              "url": "https://crates.io/crates/aws-smithy-json/0.62.7"
            },
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://aws.amazon.com/security/security-bulletins/2026-067-aws/"
            },
            {
              "tags": [
                "third-party-advisory"
              ],
              "url": "https://github.com/smithy-lang/smithy-rs/security/advisories/GHSA-8ffr-xgwf-xj56"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers",
          "x_generator": {
            "engine": "Vulnogram 1.0.4"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
        "assignerShortName": "AMZN",
        "cveId": "CVE-2026-18140",
        "datePublished": "2026-07-30T18:34:04.099Z",
        "dateReserved": "2026-07-28T18:30:40.451Z",
        "dateUpdated": "2026-07-30T19:12:50.560Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-18140

Vulnerability from fkie_nvd - Published: 2026-07-30 19:17 - Updated: 2026-10-23 22:10

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

URL	Tags
ff89ba41-3aa1-4d27-914a-91399e9639e5	https://aws.amazon.com/security/security-bulletins/2026-067-aws/	Vendor Advisory
ff89ba41-3aa1-4d27-914a-91399e9639e5	https://crates.io/crates/aws-smithy-json/0.62.7	Product
ff89ba41-3aa1-4d27-914a-91399e9639e5	https://github.com/smithy-lang/smithy-rs/security/advisories/GHSA-8ffr-xgwf-xj56	Vendor Advisory

Impacted products

	Vendor	Product	Version
	amazon	aws-smithy-json	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "aws-smithy-json",
          "vendor": "AWS",
          "versions": [
            {
              "lessThanOrEqual": "0.62.6",
              "status": "affected",
              "version": "0.32.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:amazon:aws-smithy-json:*:*:*:*:*:rust:*:*",
              "matchCriteriaId": "BDC78F08-F0CF-4631-931C-7C24AB4257FC",
              "versionEndExcluding": "0.62.7",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which the smithy-rs code generator invokes from every generated struct deserializer, might allow remote unauthenticated users to cause a denial of service (process abort via stack exhaustion) via a single small HTTP request containing deeply nested JSON to a smithy-rs generated server.\n\n\n\nTo remediate this issue, users should upgrade to aws-smithy-json 0.62.7 or later and rebuild."
    },
    {
      "lang": "es",
      "value": "Recursi\u00f3n incontrolada en la ruta de omisi\u00f3n de clave desconocida del crate de tiempo de ejecuci\u00f3n aws-smithy-json anterior a 0.62.7, que el generador de c\u00f3digo smithy-rs invoca desde cada deserializador de estructura generado, podr\u00eda permitir a usuarios remotos no autenticados causar una denegaci\u00f3n de servicio (aborto de proceso por agotamiento de pila) a trav\u00e9s de una \u00fanica peque\u00f1a solicitud HTTP que contiene JSON profundamente anidado a un servidor generado por smithy-rs.\n\nPara remediar este problema, los usuarios deber\u00edan actualizar a aws-smithy-json 0.62.7 o posterior y reconstruir."
    }
  ],
  "id": "CVE-2026-18140",
  "lastModified": "2026-10-23T22:10:00.160",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
        "type": "Secondary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-18140",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-30T19:12:34.733029Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-30T19:17:26.457",
  "references": [
    {
      "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://aws.amazon.com/security/security-bulletins/2026-067-aws/"
    },
    {
      "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
      "tags": [
        "Product"
      ],
      "url": "https://crates.io/crates/aws-smithy-json/0.62.7"
    },
    {
      "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/smithy-lang/smithy-rs/security/advisories/GHSA-8ffr-xgwf-xj56"
    }
  ],
  "sourceIdentifier": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-674"
        }
      ],
      "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
      "type": "Secondary"
    }
  ]
}

GHSA-8FFR-XGWF-XJ56

Vulnerability from github – Published: 2026-10-02 22:44 – Updated: 2026-10-02 22:44

Summary

aws-smithy-json: Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers

Details

Summary

Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations. An issue exists which allows uncontrolled recursion in the unknown-key skip path of the Amazon aws-smithy-json runtime crate in versions 0.62.6 and earlier.

Impact

Impacted versions: aws-smithy-json <= 0.62.6

Patches

This issue has been addressed in aws-smithy-json version 0.62.7. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds

There are no workarounds besides updating to the patched version.

References

If you have any questions or comments about this advisory, AWS asks that you contact [AWS/Amazon] Security via their vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

8.7 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.62.6"
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "aws-smithy-json"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.62.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-18140"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-674"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-02T22:44:52Z",
    "nvd_published_at": "2026-07-30T19:17:26Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nSmithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations. An issue exists which allows uncontrolled recursion in the unknown-key skip path of the Amazon aws-smithy-json runtime crate in versions 0.62.6 and earlier.\n\n### Impact\nUncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which the smithy-rs code generator invokes from every generated struct deserializer, might allow remote unauthenticated users to cause a denial of service (process abort via stack exhaustion) via a single small HTTP request containing deeply nested JSON to a smithy-rs generated server.\n\nImpacted versions: aws-smithy-json \u003c= 0.62.6\n\n### Patches\nThis issue has been addressed in aws-smithy-json version 0.62.7. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\n### Workarounds\nThere are no workarounds besides updating to the patched version.\n\n### References\nIf you have any questions or comments about this advisory, AWS asks that you contact [AWS/Amazon] Security via their [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.",
  "id": "GHSA-8ffr-xgwf-xj56",
  "modified": "2026-10-02T22:44:52Z",
  "published": "2026-10-02T22:44:52Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/smithy-lang/smithy-rs/security/advisories/GHSA-8ffr-xgwf-xj56"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18140"
    },
    {
      "type": "WEB",
      "url": "https://github.com/smithy-lang/smithy-rs/pull/4685"
    },
    {
      "type": "WEB",
      "url": "https://github.com/smithy-lang/smithy-rs/commit/8f0882046c467981ba5b4fd91a10befa96bd262f"
    },
    {
      "type": "WEB",
      "url": "https://aws.amazon.com/security/security-bulletins/2026-067-aws"
    },
    {
      "type": "WEB",
      "url": "https://crates.io/crates/aws-smithy-json/0.62.7"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/smithy-lang/smithy-rs"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "aws-smithy-json: Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers"
}

RHSA-2026:66521

Vulnerability from csaf_redhat - Published: 2026-09-10 16:42 - Updated: 2026-11-14 04:47

Summary

Red Hat Security Advisory: Logging for Red Hat OpenShift - 6.6.1

Severity

Important

Scope

23 vulnerabilities in this advisory, including CVE-2026-18140.

CVE-2026-18140

A flaw was found in aws-smithy-json. This vulnerability allows a remote, unauthenticated attacker to cause a denial of service (DoS) in smithy-rs generated servers. By sending a small HTTP request containing deeply nested JSON, the attacker can trigger uncontrolled recursion in the aws-smithy-json runtime, leading to stack exhaustion and a process abort. This can make the affected server unavailable to legitimate users.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 4 products Known not affected: 30 products

https://access.redhat.com/errata/RHSA-2026:66521

Open the full advisory

RHSA-2026:67593

Vulnerability from csaf_redhat - Published: 2026-09-15 18:06 - Updated: 2026-11-05 19:28

Summary

Red Hat Security Advisory: goose bug fix and enhancement update

Severity

Important

Scope

1 vulnerability in this advisory, including CVE-2026-18140.

CVE-2026-18140

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 13 products

https://access.redhat.com/errata/RHSA-2026:67593

Open the full advisory

RHSA-2026:67595

Vulnerability from csaf_redhat - Published: 2026-09-15 18:06 - Updated: 2026-11-05 19:28

Summary

Red Hat Security Advisory: goose bug fix and enhancement update

Severity

Important

Scope

1 vulnerability in this advisory, including CVE-2026-18140.

CVE-2026-18140

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 13 products

https://access.redhat.com/errata/RHSA-2026:67595

Open the full advisory

RHSA-2026:68349

Vulnerability from csaf_redhat - Published: 2026-09-16 17:49 - Updated: 2026-11-14 04:47

Summary

Red Hat Security Advisory: Logging for Red Hat OpenShift - 6.2.13

Severity

Important

Scope

14 vulnerabilities in this advisory, including CVE-2026-18140.

CVE-2026-18140

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 4 products Known not affected: 30 products

https://access.redhat.com/errata/RHSA-2026:68349

Open the full advisory

RHSA-2026:70870

Vulnerability from csaf_redhat - Published: 2026-09-23 15:01 - Updated: 2026-11-14 04:47

Summary

Red Hat Security Advisory: Logging for Red Hat OpenShift - 6.5.3

Severity

Important

Scope

24 vulnerabilities in this advisory, including CVE-2026-18140.

CVE-2026-18140

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 4 products Known not affected: 30 products

https://access.redhat.com/errata/RHSA-2026:70870

Open the full advisory

RHSA-2026:83013

Vulnerability from csaf_redhat - Published: 2026-10-14 14:50 - Updated: 2026-11-14 04:47

Summary

Red Hat Security Advisory: Logging for Red Hat OpenShift - 6.0.17

Severity

Important

Scope

23 vulnerabilities in this advisory, including CVE-2026-18140.

CVE-2026-18140

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 4 products Known not affected: 30 products

https://access.redhat.com/errata/RHSA-2026:83013

Open the full advisory

RHSA-2026:83603

Vulnerability from csaf_redhat - Published: 2026-10-15 14:32 - Updated: 2026-11-12 17:20

Summary

Red Hat Security Advisory: RHTAS 1.4.4 - Red Hat Trusted Artifact Signer Release

Severity

Important

Scope

2 vulnerabilities in this advisory, including CVE-2026-18140.

CVE-2026-18140

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 5 products

https://access.redhat.com/errata/RHSA-2026:83603

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-18140 (GCVE-0-2026-18140)

Summary

Impact

Patches

Workarounds

References

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour