CVE-2026-16756

Name of the Vulnerable Software and Affected Versions aws-smithy-http-server versions prior to 0.66.5

Description An issue in the default serve() path of Amazon aws-smithy-http-server allows unauthenticated Slowloris denial of service. This occurs due to missing connection and header-read timeouts and the absence of a concurrent-connection cap, which enables remote attackers to exhaust server sockets and tasks by opening numerous connections and sending partial requests that are never completed. Slowloris is a type of denial-of-service attack that keeps many connections to the target web server open and holds them open as long as possible.

Recommendations Upgrade to version 0.66.5 or later.