CVE-2026-15957

Name of the Vulnerable Software and Affected Versions aws-sdk-rust versions prior to release-2026-06-02 smithy-rs versions prior to release-2026-06-01

Description Uncontrolled recursion in the JSON, CBOR, and XML deserializer functions emitted by the code generation framework can lead to a denial of service. A remote attacker can cause a process abort via stack exhaustion by sending a small request containing deeply nested data for a recursive model shape to a generated SDK or server.

Recommendations Upgrade aws-sdk-rust to release-2026-06-02 or later. Regenerate custom servers using smithy-rs release-2026-06-01 or later.