CyberRota Analysis
AI-GeneratedThe aws-smithy-http-server is vulnerable due to missing connection and header-read timeouts, as well as a lack of limits on concurrent connections, which can be exploited by remote attackers to initiate a denial of service. This vulnerability allows attackers to exhaust server resources by opening numerous connections and sending incomplete requests. Organizations using this server should prioritize upgrading to version 0.66.5 or later to mitigate the risk of service disruption.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Missing connection and header-read timeouts and the absence of a concurrent-connection cap in the default serve() path of Amazon aws-smithy-http-server might allow remote attackers to cause a denial of service by opening many connections and sending partial requests that are never completed, exhausting server sockets and tasks. To mitigate this issue, users should upgrade to aws-smithy-http-server 0.66.5 or later.