CVE-2026-15957: Smithy-RS Denial of Service Vulnerability

CVE-2026-15957 Overview

CVE-2026-15957 is an uncontrolled recursion vulnerability [CWE-770] in Amazon smithy-rs, the Rust code generation and runtime framework that produces HTTP clients and servers from Smithy interface definitions. The framework powers the AWS SDK for Rust and custom service implementations. The JSON, CBOR, and XML deserializer functions emitted by smithy-rs code generation do not enforce a depth limit when parsing recursive model shapes. Remote attackers can submit a small request containing deeply nested data to trigger stack exhaustion, causing the target process to abort. The issue affects both generated SDKs and generated servers.

Critical Impact
A small, unauthenticated network request can crash any service or client built with vulnerable smithy-rs codegen, producing a denial-of-service condition against AWS SDK for Rust consumers and custom Smithy servers.

Affected Products

Amazon smithy-rs code generation prior to release-2026-06-01
AWS SDK for Rust prior to release-2026-06-02
Custom HTTP clients and servers generated from vulnerable smithy-rs releases

Discovery Timeline

2026-07-21 - CVE-2026-15957 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-15957

Vulnerability Analysis

The vulnerability resides in the deserialization routines that smithy-rs emits for recursive model shapes. Smithy models permit shapes that reference themselves, either directly or through cyclical member relationships. When the code generator produces JSON, CBOR, and XML deserializers for such shapes, it emits recursive function calls that traverse each nesting level on the native thread stack. No maximum depth is enforced during decoding.

An attacker can construct a payload of only a few kilobytes that expands into thousands of nested container frames referencing a recursive shape. Each nested element causes another stack frame to be pushed during deserialization. The thread eventually exhausts its stack, and the Rust runtime aborts the process rather than unwinding.

The impact is limited to availability, matching the CVSS vector component VA:H with no confidentiality or integrity effect. The request requires no authentication and no user interaction, so any network-reachable endpoint accepting Smithy-generated deserialization is exposed.

Root Cause

The generated deserializer functions rely on unbounded native recursion to walk recursive shape hierarchies. The codegen templates lack a depth counter or iterative rewrite, so untrusted input controls the recursion depth directly. This is a classic allocation-of-resources-without-limits weakness [CWE-770].

Attack Vector

An unauthenticated remote attacker sends a single crafted HTTP request whose body is a deeply nested JSON, CBOR, or XML document mapped to a recursive Smithy shape defined by the target service. The smithy-rs server-side deserializer, or a client parsing an attacker-influenced response, recurses until stack space is exhausted and the process aborts. Repeating the request against a supervised service produces sustained denial of service.

No verified proof-of-concept code has been published. Refer to the GitHub Security Advisory GHSA-4f2p-7j38-4xrg for authoritative technical detail.

Detection Methods for CVE-2026-15957

Indicators of Compromise

Unexpected process aborts or SIGABRT signals in services built on smithy-rs or the AWS SDK for Rust
Repeated short-lived HTTP requests with abnormally nested JSON, CBOR, or XML bodies targeting the same operation
Crash dumps showing deep recursion in generated deser_* functions produced by smithy-rs codegen

Detection Strategies

Inspect request bodies for nesting depths that exceed reasonable application limits, for example JSON structures nested beyond 100 levels.
Correlate service restart events with inbound request patterns to identify DoS attempts triggering process aborts.
Enable core-dump collection on Rust services and review stack traces for repeated frames inside generated deserializer functions.

Monitoring Recommendations

Track process restart counts, abort signals, and container respawn rates for workloads using the AWS SDK for Rust or smithy-rs-generated servers.
Alert on sudden spikes in 5xx responses or connection resets from Smithy-generated endpoints.
Log request payload sizes together with parse-failure counts to spot low-volume, high-impact abort patterns.

How to Mitigate CVE-2026-15957

Immediate Actions Required

Upgrade all Rust workloads to aws-sdk-rustrelease-2026-06-02 or later.
Regenerate any custom clients or servers using smithy-rsrelease-2026-06-01 or later and redeploy the resulting binaries.
Inventory internal services that embed generated Smithy code and prioritize internet-facing endpoints for patching.

Patch Information

Amazon addressed the vulnerability by adding depth enforcement to the generated JSON, CBOR, and XML deserializers. Fixed artifacts are published in the GitHub AWS SDK Rust Release and documented in the AWS Security Bulletin 2026-061.

Workarounds

Place a reverse proxy or API gateway in front of vulnerable services and enforce maximum request body size plus maximum JSON, CBOR, or XML nesting depth.
Restrict network exposure of Smithy-generated servers to trusted callers using authentication, mutual TLS, or private networking until patched binaries are deployed.
Run affected services under a supervisor that rate-limits restarts to prevent an attacker from triggering repeated aborts as a sustained outage.

bash

# Configuration example: update Cargo dependencies to patched releases
cargo update -p aws-config -p aws-sdk-core
cargo tree | grep -E 'aws-(sdk|smithy)' # confirm resolved versions
# Rebuild custom servers after regenerating from smithy-rs release-2026-06-01+
cargo clean && cargo build --release