CVE-2026-16756: aws-smithy-http-server Unauthenticated Slowloris Denial of Service Vulnerability
Summary
CVE-2026-16756: Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations. Affects aws-smithy-http-server versions < 0.66.5. Fixed in 0.66.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions. It powers the AWS SDK for Rust and custom service implementations, providing a robust environment for building web services. However, the default aws-smithy-http-server implementation has a vulnerability that allows unauthenticated users to exploit the server's resource allocation.
Vulnerability Detail
The vulnerability arises from the lack of connection and header-read timeouts, as well as the absence of a cap on concurrent connections in the default serve() path of the aws-smithy-http-server. This allows remote attackers to open numerous connections and send partial requests that are never completed, leading to a denial of service by exhausting server resources. The affected versions are aws-smithy-http-server <= 0.66.4, and the CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
0.66.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no workarounds available besides updating to the patched version. It is crucial to apply the update to mitigate the risk of denial of service attacks.
Conclusion
The aws-smithy-http-server vulnerability (CVE-2026-16756) poses a significant risk of denial of service due to unauthenticated Slowloris attacks. It is crucial for users of the affected versions to upgrade to version 0.66.5 or later to mitigate this risk. Regular monitoring and prompt updates are essential for maintaining security.
See every vulnerability recorded for aws-smithy-http-server →
FAQ
The vulnerability allows unauthenticated users to exploit the server's resource allocation, leading to a denial of service.
The affected versions are aws-smithy-http-server versions 0.66.4 and earlier.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
There are no workarounds available, so it is essential to prioritize upgrading to the patched version as soon as possible.
You can contact AWS Security via their vulnerability reporting page or directly via email at aws-security@amazon.com.
