AWS Patches Potential Denial of Service Flaw in Smithy RS JSON Parser
Amazon Web Services published security bulletin 2026-067-AWS on 30 July 2026, disclosing CVE-2026-18140 in the aws-smithy-json runtime crate. Smithy-rs is the Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom services. AWS states the flaw might allow remote unauthenticated users to cause a denial of service against servers generated by the framework. Every release of aws-smithy-json up to and including 0.62.6 is affected, and AWS classifies the bulletin as Important.
The vendor describes the defect as uncontrolled recursion in the unknown-key skip path, the parser routine that steps over JSON fields a service does not recognise. Because the generator invokes that path from every generated struct deserializer, the weak point is reachable from effectively any JSON-accepting operation a server exposes. The bulletin says a single small HTTP request containing deeply nested JSON might exhaust the stack and abort the process. No proof-of-concept code or further exploitation detail has been published, and AWS notes there is no workaround besides the fixed release, aws-smithy-json 0.62.7.
Services built with smithy-rs typically sit at the internet edge and accept JSON from unauthenticated callers, so an attempt costs one small request and no credentials. Forked or derivative copies of the crate carry the same defect until they pick up the upstream change. FIRST EPSS places CVE-2026-18140 at a 0.4 percent probability of exploitation in the next 30 days and no in-the-wild activity has been reported, though absence of reports is not evidence of safety. The consequence is limited to availability, an aborted process rather than data exposure, with outage length set by restart behaviour.
Attack Surface
Web Application, Cloud Service, Supply Chain (Third-party vendors)
Tactics
Impact
Techniques
- T1499 – Endpoint Denial of Service
- T1499.004 – Application or System Exploitation
SuperPRO's Threat Countermeasures Procedures
- Move affected builds onto aws-smithy-json 0.62.7, the fixed release named in AWS security bulletin 2026-067-AWS, then rebuild and redeploy every smithy-rs generated server; AWS states there is no workaround besides the patched version. With EPSS at 0.4% and no reported exploitation, this fits a normal change window rather than an emergency out-of-hours push.
- Run cargo tree -i aws-smithy-json across all Rust workspaces and build pipelines to find transitive pulls through the AWS SDK for Rust or smithy-rs codegen; any resolved version at or below 0.62.6 is in scope for CVE-2026-18140.
- Patch forked, vendored or derivative copies of aws-smithy-json as AWS instructs, by grepping Cargo.lock and vendor/ directories for aws-smithy-json entries and re-applying the upstream 0.62.7 change where the crate has been copied into internal repositories.
- Pin aws-smithy-json to 0.62.7 in Cargo.toml and Cargo.lock for every service built from smithy-rs codegen, so cached or previously pinned lockfiles cannot resolve back to the 0.62.6 and earlier releases affected by CVE-2026-18140 and GHSA-8ffr-xgwf-xj56.
- Track unexplained process terminations of smithy-rs generated servers still running aws-smithy-json 0.62.6 or earlier, since AWS describes the outcome as stack exhaustion that aborts the process, and treat an abrupt abort on a JSON-accepting operation as a possible attempt at CVE-2026-18140.
- Identify which smithy-rs generated services accept JSON from remote unauthenticated callers, as AWS scopes the flaw to that path, and schedule those internet-reachable services first in the rebuild onto aws-smithy-json 0.62.7.
