CVE-2026-18140: CWE-674: Uncontrolled Recursion in AWS aws-smithy-json
CVE-2026-18140 is a high-severity denial of service vulnerability in the aws-smithy-json runtime crate before version 0.62.7. It involves uncontrolled recursion triggered by deeply nested JSON in the unknown-key skip path of smithy-rs generated struct deserializers. Remote unauthenticated attackers can exploit this by sending a single HTTP request with crafted JSON to exhaust the stack and cause process abort. AWS manages remediation for this cloud-hosted service, and users should upgrade to version 0.62.7 or later and rebuild to mitigate the risk.
AI Analysis
Technical Summary
This vulnerability (CVE-2026-18140) affects aws-smithy-json versions prior to 0.62.7. It is caused by uncontrolled recursion in the unknown-key skip path used by smithy-rs generated struct deserializers. When processing deeply nested JSON, this flaw can lead to stack exhaustion and process abort, resulting in a denial of service. The vulnerability can be triggered remotely without authentication via a single HTTP request containing crafted JSON. AWS provides a fix in version 0.62.7 and manages remediation for the cloud-hosted service.
Potential Impact
An attacker can cause a denial of service by sending a specially crafted HTTP request with deeply nested JSON to vulnerable versions of aws-smithy-json, leading to process termination due to stack exhaustion. There is no impact on confidentiality or integrity reported. The vulnerability is remotely exploitable without authentication.
Mitigation Recommendations
A patch is available in aws-smithy-json version 0.62.7. Users should upgrade to version 0.62.7 or later and rebuild their applications to mitigate this vulnerability. Since this is a cloud-hosted service managed by AWS, the vendor handles remediation for the cloud environment. Users of the runtime crate should apply the update promptly.
CVE-2026-18140: CWE-674: Uncontrolled Recursion in AWS aws-smithy-json
Description
CVE-2026-18140 is a high-severity denial of service vulnerability in the aws-smithy-json runtime crate before version 0.62.7. It involves uncontrolled recursion triggered by deeply nested JSON in the unknown-key skip path of smithy-rs generated struct deserializers. Remote unauthenticated attackers can exploit this by sending a single HTTP request with crafted JSON to exhaust the stack and cause process abort. AWS manages remediation for this cloud-hosted service, and users should upgrade to version 0.62.7 or later and rebuild to mitigate the risk.
CVSS v3.1
Score 7.5high
Affected software
AWS
aws-smithy-json
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2026-18140) affects aws-smithy-json versions prior to 0.62.7. It is caused by uncontrolled recursion in the unknown-key skip path used by smithy-rs generated struct deserializers. When processing deeply nested JSON, this flaw can lead to stack exhaustion and process abort, resulting in a denial of service. The vulnerability can be triggered remotely without authentication via a single HTTP request containing crafted JSON. AWS provides a fix in version 0.62.7 and manages remediation for the cloud-hosted service.
Potential Impact
An attacker can cause a denial of service by sending a specially crafted HTTP request with deeply nested JSON to vulnerable versions of aws-smithy-json, leading to process termination due to stack exhaustion. There is no impact on confidentiality or integrity reported. The vulnerability is remotely exploitable without authentication.
Mitigation Recommendations
A patch is available in aws-smithy-json version 0.62.7. Users should upgrade to version 0.62.7 or later and rebuild their applications to mitigate this vulnerability. Since this is a cloud-hosted service managed by AWS, the vendor handles remediation for the cloud environment. Users of the runtime crate should apply the update promptly.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- AMZN
- Date Reserved
- 2026-07-28T18:30:40.451Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Is Cloud Service
- true
- Vendor Advisory Urls
- [{"url":"https://aws.amazon.com/security/security-bulletins/2026-067-aws/","vendor":"AWS"}]
Threat ID: 6a6ba4a59c2644c7f88ded84
Added to database: 07/30/2026, 19:23:17 UTC
Last enriched: 08/15/2026, 05:22:58 UTC
Last updated: 09/13/2026, 10:01:29 UTC
Views: 119
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.