aws-smithy-json CVE-2026-18140

Exploitation requires that the target be a smithy-rs generated server (or other Rust service) that deserializes attacker-supplied JSON using aws-smithy-json before 0.62.7 over a network-reachable endpoint - the description states the code generator invokes the vulnerable skip path from every generated struct deserializer, so no non-default feature toggle is needed. The concrete trigger is a single small HTTP request containing deeply nested JSON. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) exploitation is remote and unauthenticated against default parsing behavior. Limiting factors: impact is confined to availability (a process abort, not code execution or data disclosure); client-only consumers of the AWS SDK for Rust that never parse untrusted JSON are not exposed; and services behind a gateway enforcing JSON depth limits are protected.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H, score 8.7) is internally consistent with the description: network-reachable, low complexity, no privileges or user interaction, pure availability impact. This is a genuine, easily reachable DoS rather than an inflated high-CVSS-but-low-real-risk issue - the attack is a single small request against default parsing behavior. Impact is nonetheless bounded: no confidentiality or integrity loss, only a process abort, so blast radius depends on process supervision and load balancing. No EPSS score, SSVC decision, or POC status was provided, and the flaw is not in CISA KEV, so there is no evidence of active exploitation despite the low exploitation barrier - POC availability and active exploitation remain distinct and both are currently unconfirmed. Net priority is elevated for anyone running smithy-rs generated servers on an untrusted network and moderate for client-only consumers that never deserialize attacker-controlled JSON.

An attacker sends a single small HTTP request whose JSON body contains many levels of nesting (for example a long run of opening braces or arrays) to a public endpoint served by a smithy-rs generated Rust server. The generated deserializer recurses through the nested structure while skipping keys, exhausts the thread's stack, and the process aborts, denying service to all users. No authentication, user interaction, or POC tooling is required, and no public exploit was identified at time of analysis.