CVE-2026-15957 AWS CVE debrief

Who should care

Users of the AWS SDK for Rust and custom service implementations built with Smithy-RS should assess their exposure and upgrade to patched versions to prevent denial of service attacks.

Why it matters

CVE-2026-15957 is a high-severity vulnerability in Smithy-RS that could allow remote attackers to cause a denial of service. Users of the AWS SDK for Rust and custom service implementations should assess their exposure and upgrade to patched versions.

• Denial of service via process abort due to stack exhaustion
• Potential for service disruption or degradation
• Need for verification of affected versions and deployments
• Priority for upgrading to patched versions of aws-sdk-rust and smithy-rs

Technical summary

Uncontrolled recursion in the JSON, CBOR, and XML deserializer functions emitted by Amazon smithy-rs code generation could allow remote attackers to cause a denial of service via a small request containing deeply nested data for a recursive model shape to a generated SDK or server. This issue affects the AWS SDK for Rust and custom service implementations, potentially leading to process abort via stack exhaustion. Users should assess their exposure and upgrade to patched versions to prevent denial of service attacks.

Defensive priority

Upgrade to patched versions of aws-sdk-rust and smithy-rs to prevent denial of service attacks.

Recommended defensive actions

• Upgrade to aws-sdk-rust release-2026-06-02 or later
• Regenerate custom servers with smithy-rs release-2026-06-01 or later
• Review and update affected deployments to ensure they are using patched versions
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability is caused by uncontrolled recursion in the JSON, CBOR, and XML deserializer functions emitted by Amazon smithy-rs code generation. This could allow remote attackers to cause a denial of service via a small request containing deeply nested data.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.