CVE-2026-15957: Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom servic

highCVSS 7.5CVE-2026-15957

Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations. Uncontrolled recursion in the JSON, CBOR, and XML deserializer functions emitted by Amazon smithy-rs code generation could allow remote attackers to cause a denial of service (process abort via stack exhaustion) via a small request containing deeply nested data for a recursive model shape to a generated SDK or server. To mitigate this issue, users should upgrade to aws-sdk-rust release-2026-06-02 or later. Users building custom servers with smithy-rs codegen should regenerate from smithy-rs release-2026-06-01 or later.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: high — CVSS 7.5
Published: 2026-07-21
Last updated: 2026-07-22
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-15957

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-159570.42% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 34% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-15957	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

unknownCVE-2026-15957 - Uncontrolled recursion in smithy-rs generated JSON, CBOR, and XML deserializers allows unauth…aws

Recent advisories for Smithy-RS is a

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

unknownCVE-2026-18140 - Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated re…aws · 2026-07-31
highCVE-2026-18140: Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate befor…nvd · 2026-07-30
highGHSA-jvxp-qmx7-gjpx: Smithy-RS: Allocation of resources without limits in the default aws-smithy-http-server s…ghsa · 2026-07-24
unknownCVE-2026-15957 - Uncontrolled recursion in smithy-rs generated JSON, CBOR, and XML deserializers allows unauth…aws · 2026-07-21