Aws Sdk Rust
Monthly
Denial of service in Amazon's smithy-rs code generation framework allows remote attackers to abort the process via stack exhaustion by sending a small request containing deeply nested data that matches a recursive model shape. The flaw affects generated deserializers for JSON, CBOR, and XML across the AWS SDK for Rust and any custom clients or servers built with smithy-rs codegen; because deserialization runs before business logic, a compact malicious payload can crash the target. This carries a CVSS 4.0 base score of 8.7 (availability-only impact), and no public exploit was identified at time of analysis.
Denial of service in Amazon's smithy-rs code generation framework allows remote attackers to abort the process via stack exhaustion by sending a small request containing deeply nested data that matches a recursive model shape. The flaw affects generated deserializers for JSON, CBOR, and XML across the AWS SDK for Rust and any custom clients or servers built with smithy-rs codegen; because deserialization runs before business logic, a compact malicious payload can crash the target. This carries a CVSS 4.0 base score of 8.7 (availability-only impact), and no public exploit was identified at time of analysis.