CyberRota Analysis
AI-GeneratedThe Smithy-RS framework is vulnerable to uncontrolled recursion in its deserializer functions, which can be exploited by remote attackers to trigger a denial of service through deeply nested data in requests, leading to stack exhaustion and process termination. Organizations utilizing the AWS SDK for Rust or developing custom services with Smithy-RS should prioritize upgrading to the specified releases to mitigate this high-severity risk. Immediate action is essential to protect against potential service disruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations. Uncontrolled recursion in the JSON, CBOR, and XML deserializer functions emitted by Amazon smithy-rs code generation could allow remote attackers to cause a denial of service (process abort via stack exhaustion) via a small request containing deeply nested data for a recursive model shape to a generated SDK or server. To mitigate this issue, users should upgrade to aws-sdk-rust release-2026-06-02 or later. Users building custom servers with smithy-rs codegen should regenerate from smithy-rs release-2026-06-01 or later.