Vulnerability Details CVE-2026-18140
Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which the smithy-rs code generator invokes from every generated struct deserializer, might allow remote unauthenticated users to cause a denial of service (process abort via stack exhaustion) via a single small HTTP request containing deeply nested JSON to a smithy-rs generated server.
To remediate this issue, users should upgrade to aws-smithy-json 0.62.7 or later and rebuild.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 35.9%
CVSS Severity
CVSS v3 Score 7.5
References
Products affected by CVE-2026-18140
-
cpe:2.3:a:amazon:aws-smithy-json:0.27.0
-
cpe:2.3:a:amazon:aws-smithy-json:0.28.0
-
cpe:2.3:a:amazon:aws-smithy-json:0.30.0
-
cpe:2.3:a:amazon:aws-smithy-json:0.31.0
-
cpe:2.3:a:amazon:aws-smithy-json:0.32.0
-
cpe:2.3:a:amazon:aws-smithy-json:0.33.1
-
cpe:2.3:a:amazon:aws-smithy-json:0.34.0
-
cpe:2.3:a:amazon:aws-smithy-json:0.34.1
-
cpe:2.3:a:amazon:aws-smithy-json:0.35.1
-
cpe:2.3:a:amazon:aws-smithy-json:0.35.2
-
cpe:2.3:a:amazon:aws-smithy-json:0.36.0
-
cpe:2.3:a:amazon:aws-smithy-json:0.37.0
-
cpe:2.3:a:amazon:aws-smithy-json:0.38.0
-
cpe:2.3:a:amazon:aws-smithy-json:0.39.0
-
cpe:2.3:a:amazon:aws-smithy-json:0.40.2
-
cpe:2.3:a:amazon:aws-smithy-json:0.41.0
-
cpe:2.3:a:amazon:aws-smithy-json:0.42.0
-
cpe:2.3:a:amazon:aws-smithy-json:0.43.0
-
cpe:2.3:a:amazon:aws-smithy-json:0.44.0
-
cpe:2.3:a:amazon:aws-smithy-json:0.45.0
-
cpe:2.3:a:amazon:aws-smithy-json:0.46.0
-
cpe:2.3:a:amazon:aws-smithy-json:0.47.0
-
cpe:2.3:a:amazon:aws-smithy-json:0.48.0
-
cpe:2.3:a:amazon:aws-smithy-json:0.49.0
-
cpe:2.3:a:amazon:aws-smithy-json:0.50.0
-
cpe:2.3:a:amazon:aws-smithy-json:0.51.0
-
cpe:2.3:a:amazon:aws-smithy-json:0.52.0
-
cpe:2.3:a:amazon:aws-smithy-json:0.53.0
-
cpe:2.3:a:amazon:aws-smithy-json:0.53.1
-
cpe:2.3:a:amazon:aws-smithy-json:0.54.0
-
cpe:2.3:a:amazon:aws-smithy-json:0.54.1
-
cpe:2.3:a:amazon:aws-smithy-json:0.54.2
-
cpe:2.3:a:amazon:aws-smithy-json:0.54.3
-
cpe:2.3:a:amazon:aws-smithy-json:0.54.4
-
cpe:2.3:a:amazon:aws-smithy-json:0.55.0
-
cpe:2.3:a:amazon:aws-smithy-json:0.55.1
-
cpe:2.3:a:amazon:aws-smithy-json:0.55.2
-
cpe:2.3:a:amazon:aws-smithy-json:0.55.3
-
cpe:2.3:a:amazon:aws-smithy-json:0.56.0
-
cpe:2.3:a:amazon:aws-smithy-json:0.56.1
-
cpe:2.3:a:amazon:aws-smithy-json:0.57.0
-
cpe:2.3:a:amazon:aws-smithy-json:0.57.1
-
cpe:2.3:a:amazon:aws-smithy-json:0.57.2
-
cpe:2.3:a:amazon:aws-smithy-json:0.58.0
-
cpe:2.3:a:amazon:aws-smithy-json:0.59.0
-
cpe:2.3:a:amazon:aws-smithy-json:0.60.0
-
cpe:2.3:a:amazon:aws-smithy-json:0.60.1
-
cpe:2.3:a:amazon:aws-smithy-json:0.60.2
-
cpe:2.3:a:amazon:aws-smithy-json:0.60.3
-
cpe:2.3:a:amazon:aws-smithy-json:0.60.4
-
cpe:2.3:a:amazon:aws-smithy-json:0.60.5
-
cpe:2.3:a:amazon:aws-smithy-json:0.60.6
-
cpe:2.3:a:amazon:aws-smithy-json:0.60.7
-
cpe:2.3:a:amazon:aws-smithy-json:0.61.0
-
cpe:2.3:a:amazon:aws-smithy-json:0.61.1
-
cpe:2.3:a:amazon:aws-smithy-json:0.61.2
-
cpe:2.3:a:amazon:aws-smithy-json:0.61.3
-
cpe:2.3:a:amazon:aws-smithy-json:0.61.4
-
cpe:2.3:a:amazon:aws-smithy-json:0.61.5
-
cpe:2.3:a:amazon:aws-smithy-json:0.61.6
-
cpe:2.3:a:amazon:aws-smithy-json:0.61.7
-
cpe:2.3:a:amazon:aws-smithy-json:0.61.8
-
cpe:2.3:a:amazon:aws-smithy-json:0.61.9
-
cpe:2.3:a:amazon:aws-smithy-json:0.62.0
-
cpe:2.3:a:amazon:aws-smithy-json:0.62.1
-
cpe:2.3:a:amazon:aws-smithy-json:0.62.2
-
cpe:2.3:a:amazon:aws-smithy-json:0.62.3
-
cpe:2.3:a:amazon:aws-smithy-json:0.62.4
-
cpe:2.3:a:amazon:aws-smithy-json:0.62.5
-
cpe:2.3:a:amazon:aws-smithy-json:0.62.6