CVE-2026-16756

HIGH8.7

Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service

Published Jul 23, 2026

Modified 1 weeks ago

Details

Missing connection and header-read timeouts and the absence of a concurrent-connection cap in the default serve() path of Amazon aws-smithy-http-server might allow remote attackers to cause a denial of service by opening many connections and sending partial requests that are never completed, exhausting server sockets and tasks.

To mitigate this issue, users should upgrade to aws-smithy-http-server 0.66.5 or later.

References

ADVISORY

https://aws.amazon.com/security/security-bulletins/2026-064-aws/

FIX

https://crates.io/crates/aws-smithy-http-server/0.66.5

WEB

https://github.com/smithy-lang/smithy-rs/security/advisories/GHSA-jvxp-qmx7-gjpx

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-16756

CVSS Analysis

CVSS v4.0