Skip to main content

aws-smithy-http-server CVE-2026-16756

| EUVDEUVD-2026-48362 HIGH
Allocation of Resources Without Limits or Throttling (CWE-770)
2026-07-23 AMZN GHSA-jvxp-qmx7-gjpx
Denial Of Service AWS Aws Smithy Http Server
8.7
CVSS 4.0 · Vendor: AMZN
Share

Severity by source

Vendor (AMZN) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Remote unauthenticated slowloris needs no privileges or interaction (AV:N/AC:L/PR:N/UI:N), impact is availability-only (A:H, C:N/I:N) with no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (AMZN).

CVSS VectorVendor: AMZN

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

5
Analysis Updated
Jul 23, 2026 - 19:28 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 23, 2026 - 19:23 vuln.today
cvss_changed
CVSS changed
Jul 23, 2026 - 19:23 NVD
7.5 (HIGH) 8.7 (HIGH)
Analysis Generated
Jul 23, 2026 - 19:21 vuln.today
CVE Published
Jul 23, 2026 - 18:32 cve.org
HIGH 7.5

DescriptionCVE.org

Missing connection and header-read timeouts and the absence of a concurrent-connection cap in the default serve() path of Amazon aws-smithy-http-server might allow remote attackers to cause a denial of service by opening many connections and sending partial requests that are never completed, exhausting server sockets and tasks.

To mitigate this issue, users should upgrade to aws-smithy-http-server 0.66.5 or later.

AnalysisAI

Denial of service in Amazon's aws-smithy-http-server Rust crate (versions prior to 0.66.5) lets remote unauthenticated attackers exhaust server sockets and async tasks by opening many connections and trickling partial requests that never complete. The default serve() path ships without connection read/header timeouts or a concurrent-connection cap, so a classic slowloris-style flood can hang the service indefinitely. No public exploit has been identified at time of analysis, though the technique is well-understood and the CVSS 4.0 base score is 8.7 (High).

Technical ContextAI

aws-smithy-http-server is the Rust server runtime generated by smithy-rs, the AWS SDK code-generation toolchain that turns Smithy service models into HTTP/JSON or protocol-specific server stubs; it underlies Rust services built on the Smithy framework. The flaw is a CWE-770 (Allocation of Resources Without Limits or Throttling) issue: the default serve() convenience path binds a listener and spawns a task per accepted connection without enforcing a header-read deadline, an overall connection idle timeout, or a ceiling on simultaneously open connections. Because each half-open connection consumes a file descriptor and a live async task on the Tokio runtime, an attacker can pin these finite resources open. The single affected CPE is cpe:2.3:a:aws:aws-smithy-http-server:*:*:*:*:*:*:*:*.

RemediationAI

Vendor-released patch: upgrade aws-smithy-http-server to 0.66.5 or later via crates.io (https://crates.io/crates/aws-smithy-http-server/0.66.5) and rebuild/redeploy affected Rust services; consult the AWS bulletin 2026-064 (https://aws.amazon.com/security/security-bulletins/2026-064-aws/) and GHSA-jvxp-qmx7-gjpx (https://github.com/smithy-lang/smithy-rs/security/advisories/GHSA-jvxp-qmx7-gjpx). Until you can upgrade, front the service with a reverse proxy or load balancer (e.g. NGINX, ALB, Envoy) configured with short client-header and idle-connection timeouts plus a per-source connection cap, which terminates half-open slowloris connections before they reach the server - the trade-off is added infrastructure and possible false-positive drops of legitimately slow clients on constrained networks. Alternatively, replace the default serve() call with a custom listener/server builder that sets explicit header-read timeouts and a bounded concurrent-connection limit; the side effect is that the connection ceiling can reject legitimate traffic under genuine load spikes, so size it against observed peak concurrency.

More in AWS

View all
CVE-2026-27702 CRITICAL POC
9.9 Feb 25

Unauthorized data access in Budibase low-code platform before 3.30.4 allows unauthenticated users to manipulate internal
CVE-2020-37153 CRITICAL POC
9.8 Feb 11

Multiple vulnerabilities in ASTPP 4.0.1 including XSS and command injection in SIP device configuration and plugin manag
CVE-2026-11393 HIGH POC
8.8 Jun 08

Remote code execution in AWS AgentCore CLI before v0.14.2 allows authenticated attackers to inject Python code via craft
CVE-2026-16796 HIGH POC
8.4 Jul 23

Argument injection in the AWS Bedrock AgentCore Python SDK before 1.18.1 lets a remote authenticated user run arbitrary

CVE-2026-9133 HIGH POC
8.3 May 20

Arbitrary file read in amazon-mq rabbitmq-aws before 0.2.1 allows authenticated remote users to read any file accessible
CVE-2026-13763 HIGH POC
7.9 Jun 29

WAF managed-rule body inspection on AWS Application Load Balancer (ALB) can be bypassed by remote actors who fragment an
CVE-2026-13762 HIGH POC
7.9 Jun 29

WAF inspection bypass in Amazon CloudFront (with AWS WAF enabled) lets remote actors smuggle malicious request bodies pa
CVE-2026-4295 HIGH POC
7.8 Mar 17

A trust boundary enforcement vulnerability in Kiro IDE allows remote attackers to execute arbitrary code when a local us
CVE-2019-25333 HIGH POC
7.5 Feb 12

Bullwark Momentum Series JAWS 1.0 contains a directory traversal vulnerability that allows unauthenticated attackers to

CVE-2026-7461 HIGH POC
7.5 Apr 30

Command injection in Amazon ECS Agent on Windows allows authenticated attackers with task definition permissions to exec
CVE-2026-16584 HIGH POC
7.3 Jul 23

Security-policy bypass in the awslabs AWS API MCP Server (versions 0.2.13 through 1.3.46) lets an actor invoke AWS API o
CVE-2026-11417 HIGH POC
7.0 Jun 10

OS command injection in the NodejsFunction local bundling pipeline of aws-cdk-lib prior to 2.245.0 (2.246.0 on Windows)

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

View all
CVE-2017-8779 HIGH POC
7.5
CVE-2025-53521 CRITICAL POC
9.3
CVE-2017-5850 HIGH POC
7.5
CVE-2025-26682 HIGH
7.5
CVE-2025-41770 HIGH
8.7
CVE-2025-26466 MEDIUM
5.9
CVE-2020-37067 CRITICAL POC
9.8
CVE-2021-47875 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Public Cloud 15 SP7 Affected

Share

CVE-2026-16756 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy