Which versions of smithy-rs are affected by EUVD-2026-46386?

Amazon's smithy-rs code generation framework contains a denial-of-service vulnerability allowing remote attackers to crash applications with a small malicious payload, impacting any organization…. A patch is available.

How to fix or mitigate EUVD-2026-46386?

Within 24 hours, identify all systems and services in your environment using the AWS SDK for Rust or applications generated with smithy-rs codegen, catalog their current versions, and check Amazon's security advisories for available patches. Within 7 days, obtain and deploy the available vendor patch to development and staging environments, conduct thorough testing of JSON, CBOR, and XML deserialization pathways, and establish a validated rollout plan for production systems. Within 30 days, complete deployment of patched versions across all production infrastructure, perform post-deployment validation to confirm no service interruptions occur, and document the update in your change management system.

smithy-rs EUVD-2026-46386

Q: What is the CVSS score of EUVD-2026-46386?

EUVD-2026-46386 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-15957 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-07-21 AMZN

Denial Of Service AWS Aws Sdk Rust

8.7

CVSS 4.0 · Vendor: AMZN

Severity by source

Vendor (AMZN) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Unauthenticated, low-complexity network request crashes the process; impact is availability-only (A:H) with no confidentiality or integrity effect, matching the vendor's DoS-only classification.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (AMZN).

CVSS VectorVendor: AMZN

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 21, 2026 - 20:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 21, 2026 - 20:22 vuln.today

cvss_changed

CVSS changed

Jul 21, 2026 - 20:22 NVD

7.5 (HIGH) 8.7 (HIGH)

Source Code Evidence Fetched

Jul 21, 2026 - 20:01 vuln.today

Analysis Generated

Jul 21, 2026 - 20:01 vuln.today

CVE Published

Jul 21, 2026 - 19:33 cve.org

HIGH 7.5

DescriptionCVE.org

Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations.

Uncontrolled recursion in the JSON, CBOR, and XML deserializer functions emitted by Amazon smithy-rs code generation could allow remote attackers to cause a denial of service (process abort via stack exhaustion) via a small request containing deeply nested data for a recursive model shape to a generated SDK or server.

To mitigate this issue, users should upgrade to aws-sdk-rust release-2026-06-02 or later. Users building custom servers with smithy-rs codegen should regenerate from smithy-rs release-2026-06-01 or later.

AnalysisAI

Denial of service in Amazon's smithy-rs code generation framework allows remote attackers to abort the process via stack exhaustion by sending a small request containing deeply nested data that matches a recursive model shape. The flaw affects generated deserializers for JSON, CBOR, and XML across the AWS SDK for Rust and any custom clients or servers built with smithy-rs codegen; because deserialization runs before business logic, a compact malicious payload can crash the target. This carries a CVSS 4.0 base score of 8.7 (availability-only impact), and no public exploit was identified at time of analysis.

Technical ContextAI

smithy-rs is a Rust code-generation and runtime framework that produces HTTP clients and servers from Smithy interface definitions, and it underpins the AWS SDK for Rust (CPE cpe:2.3:a:aws:aws-sdk-rust). The vulnerability is a CWE-770 (Allocation of Resources Without Limits or Throttling) manifesting as uncontrolled recursion: the deserializer functions emitted by codegen for JSON, CBOR, and XML recursively descend into nested structures without a depth bound. When a Smithy model defines a recursive shape (a structure that can contain itself, directly or indirectly), the generated parser follows attacker-controlled nesting depth-first, consuming native stack frames per level until the thread's stack is exhausted, which in Rust triggers an unrecoverable process abort rather than a catchable error.

RemediationAI

Vendor-released patch: upgrade the AWS SDK for Rust to release-2026-06-02 or later (https://github.com/awslabs/aws-sdk-rust/releases/tag/release-2026-06-02). Developers who build custom clients or servers with smithy-rs must regenerate their code from smithy-rs release-2026-06-01 or later and redeploy the regenerated artifacts, since the fix lives in the emitted deserializer code rather than a runtime-only dependency. Consult the AWS bulletin (https://aws.amazon.com/security/security-bulletins/2026-061-aws/) and GHSA-4f2p-7j38-4xrg for details. Where immediate patching is not possible, compensating controls include placing a reverse proxy or API gateway in front of exposed smithy-rs servers to reject requests exceeding a maximum body size or JSON/XML/CBOR nesting depth (trade-off: proxies that do not parse CBOR/XML may not enforce depth for those encodings, and overly strict limits can break legitimate deeply-nested payloads), and restricting network exposure of affected endpoints to trusted callers to reduce the unauthenticated attack surface.