CVE-2026-18140

Name of the Vulnerable Software and Affected Versions aws-smithy-json versions prior to 0.62.7

Description Uncontrolled recursion occurs in the unknown-key skip path of the runtime crate, which is invoked by the smithy-rs code generator from every generated struct deserializer. This allows remote unauthenticated users to trigger a denial of service, resulting in a process abort due to stack exhaustion, by sending a single small HTTP request containing deeply nested JSON to a smithy-rs generated server.

Recommendations Upgrade to aws-smithy-json version 0.62.7 or later and rebuild.