CVE-2026-15957 involves uncontrolled recursion in JSON, CBOR, and XML deserializer functions generated by the Smithy-RS code generation framework used in the AWS SDK for Rust. This can lead to process abort due to stack exhaustion when a crafted request with deeply nested recursive model shapes is processed. The vulnerability affects aws-sdk-rust crate versions before release-2026-06-0. AWS has acknowledged the issue and manages remediation for this cloud service. The CVSS v3.1 score is 7.5 (high severity), reflecting a network attack vector with no privileges or user interaction required, causing denial of service impact.

The vulnerability allows a remote attacker to cause a denial of service by sending a small request containing deeply nested recursive data, leading to stack exhaustion and process abort in applications using the affected aws-sdk-rust versions. There is no impact on confidentiality or integrity, only availability is affected.

AWS manages remediation for this cloud-hosted service. Users should refer to the AWS Security Bulletin (https://aws.amazon.com/security/security-bulletins/2026-061-aws/) for the latest updates and ensure they are using patched versions of the aws-sdk-rust crate (release-2026-06-0 or later). Since this is a cloud service, AWS typically applies patches server-side. No additional user action is required beyond updating to a fixed version when available.