Unauthenticated remote denial of service risk in AWS Smithy-RS deserializers
Attackers can crash Rust-based AWS SDK servers by sending small, deeply nested data requests that exhaust stack space without needing credentials.
Key points
- CVE-2026-15957 affects AWS SDK for Rust versions prior to release-2026-06-02.
- The flaw allows unauthenticated remote denial of service via stack exhaustion.
- AWS confirms no workaround exists other than updating to the patched version.
Attackers gained the ability to crash servers running the AWS SDK for Rust by sending small requests containing deeply nested data. This unauthenticated remote denial of service vulnerability, tracked as CVE-2026-15957, required no credentials. According to AWS Security Bulletins published on July 21, 2026, the issue allowed third parties to cause process aborts via stack exhaustion.
In plain English
The Smithy-RS framework generates code for HTTP clients and servers from interface definitions. It powers the AWS SDK for Rust and custom service implementations. The vulnerability existed in the JSON, CBOR, and XML deserializer functions created by this code generation. A small request with recursive model shapes could trigger uncontrolled recursion within these deserializers.
The background
AWS identified the flaw in smithy-rs generated deserializers. The issue impacted aws-sdk-rust crates earlier than release-2026-06-0. The company addressed the problem in release-2026-06-02. AWS stated there is no workaround beyond updating to the patched versions. They recommend ensuring forked or derivative code incorporates the new fixes.
What changes now
Teams using the AWS SDK for Rust must verify their current version. Any installation running a crate version before release-2026-06-02 is vulnerable. Users should upgrade to the latest version immediately. AWS advises checking forked or derivative code to ensure it includes the necessary patches to mitigate the denial of service risk.
What made it possible
Teams usually face risks when software processes nested data structures without limiting depth. This class of weakness occurs when a parser follows recursive shapes until system resources are depleted. It serves the initial impact stage of an intrusion by denying service rather than granting access. Check whether your services validate input size and structure before processing. Monitor for sudden resource spikes that indicate stack exhaustion attempts. Ensure your architecture rejects overly complex payloads early in the request lifecycle to prevent resource exhaustion.
What to do and how to stay safe: AWS
- Verify if your systems use aws-sdk-rust crates older than release-2026-06-02.
- Update to the patched version or later to resolve the recursion flaw.
- Review forked or derivative code to ensure it includes the official fixes.
- Monitor server logs for signs of stack exhaustion from small, nested requests.
Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed
General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVE ID for this AWS Smithy-RS vulnerability?
The vulnerability is tracked as CVE-2026-15957.
Is there a workaround for CVE-2026-15957 besides updating?
No, AWS states there is no workaround beyond updating to the patched versions.
Which AWS SDK versions are affected by this issue?
All aws-sdk-rust crates prior to release-2026-06-0 are impacted.
