CVE-2026-18140 is a denial of service vulnerability in the goose package used in Red Hat Enterprise Linux 10. The flaw arises from uncontrolled recursion when handling deeply nested JSON structures in the aws-smithy-json component, which can lead to application crashes or service disruption. Red Hat has issued a security advisory (RHSA-2026:67593) and released goose version 1.38.0-1.el10_2 as a fix. The advisory covers multiple architectures and instructs users to apply the update after ensuring all previous errata are installed.

The vulnerability allows an attacker to cause a denial of service condition by triggering uncontrolled recursion with deeply nested JSON input. This can result in the affected process crashing or becoming unresponsive, impacting availability of services relying on the goose component. There is no indication of code execution or data breach from this vulnerability. No known exploits in the wild have been reported.

Red Hat has released an official fix in goose version 1.38.0-1.el10_2 for Red Hat Enterprise Linux 10 across supported architectures. Users should apply this update promptly following the instructions in Red Hat article 11258 and ensure all previous relevant errata are applied. No additional mitigation steps are required beyond applying the official update.