What’s Vulnerable › Vulnerabilities

CVE-2026-16756: Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-23 · updated 2026-10-24
• Weakness: CWE-770

Description

Missing connection and header-read timeouts and the absence of a concurrent-connection cap in the default serve() path of Amazon aws-smithy-http-server might allow remote attackers to cause a denial of service by opening many connections and sending partial requests that are never completed, exhausting server sockets and tasks. To mitigate this issue, users should upgrade to aws-smithy-http-server 0.66.5 or later.

Affected products

• aws-smithy-http-server: through 0.66.4

References

• https://aws.amazon.com/security/security-bulletins/2026-064-aws/
• https://crates.io/crates/aws-smithy-http-server/0.66.5
• https://github.com/smithy-lang/smithy-rs/security/advisories/GHSA-jvxp-qmx7-gjpx

Get alerted when CVE-2026-16756 or the next vulnerability affects your stack