{"id":"CVE-2026-15957","summary":"Uncontrolled recursion in smithy-rs generated JSON, CBOR, and XML deserializers allows unauthenticated remote denial of service via recursive shapes","details":"Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations.\n\n\n\nUncontrolled recursion in the JSON, CBOR, and XML deserializer functions emitted by Amazon smithy-rs code generation could allow remote attackers to cause a denial of service (process abort via stack exhaustion) via a small request containing deeply nested data for a recursive model shape to a generated SDK or server.\n\n\n\nTo mitigate this issue, users should upgrade to aws-sdk-rust release-2026-06-02 or later. Users building custom servers with smithy-rs codegen should regenerate from smithy-rs release-2026-06-01 or later.","aliases":["GHSA-4f2p-7j38-4xrg"],"modified":"2026-07-24T03:57:07.166117787Z","published":"2026-07-21T19:33:55.409Z","database_specific":{"cna_assigner":"AMZN","cwe_ids":["CWE-770"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15957.json"},"references":[{"type":"ADVISORY","url":"https://aws.amazon.com/security/security-bulletins/2026-061-aws/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15957.json"},{"type":"ADVISORY","url":"https://github.com/smithy-lang/smithy-rs/security/advisories/GHSA-4f2p-7j38-4xrg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15957"},{"type":"FIX","url":"https://github.com/awslabs/aws-sdk-rust/releases/tag/release-2026-06-02"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/awslabs/aws-sdk-rust","events":[{"introduced":"0"},{"fixed":"4926e3bd41e42921c9fa9c6314056cfc59a3f02d"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"release-2026-06-02"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["release-2026-04-27","release-2026-06-01","release-2026-05-29","release-2026-05-28","release-2026-05-27","release-2026-05-26","release-2026-05-22","release-2026-05-21","release-2026-05-20","release-2026-05-19","release-2026-05-18","release-2026-05-15","release-2026-05-14","release-2026-05-13","release-2026-05-07","release-2026-05-06","release-2026-05-05","release-2026-05-04","release-2026-05-01","release-2026-04-30","release-2026-04-29","release-2026-04-24","release-2026-04-23","release-2026-04-22","release-2026-04-21","release-2026-04-20","release-2026-04-17","release-2026-04-16","release-2026-04-13","release-2026-04-10","release-2026-04-09","release-2026-04-08","release-2026-04-07","release-2026-04-06","release-2026-04-03","release-2026-04-02","release-2026-04-01","release-2026-03-31","release-2026-03-30","release-2026-03-27","release-2026-03-26","release-2026-03-25","release-2026-03-24","release-2026-03-23","release-2026-03-20","release-2026-03-19","release-2026-03-18","release-2026-03-17","release-2026-03-16","release-2026-03-13","release-2026-03-12","release-2026-03-11","release-2026-03-10","release-2026-03-09","release-2026-03-06","release-2026-03-05","release-2026-03-04","release-2026-03-03","release-2026-02-27","release-2026-02-26","release-2026-02-25","release-2026-02-24","release-2026-02-23","release-2026-02-20","release-2026-02-19","release-2026-02-18","release-2026-02-17","release-2026-02-16","release-2026-02-13","release-2026-02-12","release-2026-02-11","release-2026-02-10","release-2026-02-09","release-2026-02-06","release-2026-02-05","release-2026-02-04","release-2026-02-03","release-2026-02-02","release-2026-01-30","release-2026-01-29","release-2026-01-28","release-2026-01-27","release-2026-01-26","release-2026-01-23","release-2026-01-22","release-2026-01-21","release-2026-01-20","release-2026-01-16","release-2026-01-15","release-2026-01-14","release-2026-01-13","release-2026-01-12","release-2026-01-09","release-2026-01-07","release-2026-01-06","release-2026-01-05","release-2026-01-02","release-2025-12-30","release-2025-12-29","release-2025-12-26","release-2025-12-23","release-2025-12-22","release-2025-12-19","release-2025-12-18","release-2025-12-17","release-2025-12-16","release-2025-12-15","release-2025-12-12","release-2025-12-11","release-2025-12-10","release-2025-12-09","release-2025-12-08","release-2025-12-05","release-2025-12-04","release-2025-12-03","release-2025-12-02","release-2025-12-01","release-2025-11-26","release-2025-11-25","release-2025-11-24","release-2025-11-21","release-2025-11-20.2","release-2025-11-20","release-2025-11-19","release-2025-11-18","release-2025-11-17","release-2025-11-14","release-2025-11-13","release-2025-11-12","release-2025-11-11","release-2025-11-10","release-2025-11-07","release-2025-11-06","release-2025-11-05","release-2025-11-04","release-2025-11-03","release-2025-11-01","release-2025-10-30","release-2025-10-29","release-2025-10-28","release-2025-10-27","release-2025-10-24","release-2025-10-23","release-2025-10-22","release-2025-10-21","release-2025-10-17","release-2025-10-16","release-2025-10-15","release-2025-10-14","release-2025-10-13","release-2025-10-10","release-2025-10-09","release-2025-10-08","release-2025-10-07","release-2025-10-06","release-2025-10-03.2","release-2025-10-03","release-2025-10-01","release-2025-09-30","release-2025-09-29","release-2025-09-26","release-2025-09-25","release-2025-09-24","release-2025-09-23","release-2025-09-22","release-2025-09-19","release-2025-09-18","release-2025-09-17","release-2025-09-16","release-2025-09-15","release-2025-09-12","release-2025-09-11","release-2025-09-10","release-2025-09-09","release-2025-09-08","release-2025-09-05","release-2025-09-04","release-2025-09-03","release-2025-09-02","release-2025-08-29","release-2025-08-28","release-2025-08-27","release-2025-08-26","release-2025-08-25","release-2025-08-22","release-2025-08-21","release-2025-08-20","release-2025-08-19","release-2025-08-18","release-2025-08-15","release-2025-08-14","release-2025-08-13","release-2025-08-12","release-2025-08-11","release-2025-08-08","release-2025-08-07","release-2025-08-06","release-2025-08-05","release-2025-08-04","release-2025-08-01","release-2025-07-31","release-2025-07-30","release-2025-07-29","release-2025-07-28","release-2025-07-25","release-2025-07-24","release-2025-07-23","release-2025-07-22","release-2025-07-21","release-2025-07-18","release-2025-07-17","release-2025-07-16.2","release-2025-07-16","release-2025-07-15","release-2025-07-09","release-2025-07-03","release-2025-07-02","release-2025-07-01","release-2025-06-30","release-2025-06-27","release-2025-06-26","release-2025-06-25","release-2025-06-24","release-2025-06-23","release-2025-06-20","release-2025-06-19","release-2025-06-18","release-2025-06-17","release-2025-06-16","release-2025-06-12","release-2025-06-11","release-2025-06-10","release-2025-06-09","release-2025-06-06","release-2025-06-05.2","release-2025-06-05","release-2025-06-03","release-2025-06-02","release-2025-05-30","release-2025-05-29","release-2025-05-28","release-2025-05-27","release-2025-05-23","release-2025-05-22","release-2025-05-21","release-2025-05-20","release-2025-05-19","release-2025-05-16","release-2025-05-15","release-2025-05-14","release-2025-05-13","release-2025-05-12","release-2025-05-09.2","release-2025-05-09","release-2025-05-07","release-2025-05-06","release-2025-05-05","release-2025-05-02","release-2025-05-01","release-2025-04-30","release-2025-04-29","release-2025-04-28","release-2025-04-25","release-2025-04-24","release-2025-04-23","release-2025-04-22","release-2025-04-21","release-2025-04-18","release-2025-04-17","release-2025-04-16","release-2025-04-14","release-2025-04-11","release-2025-04-10","release-2025-04-09","release-2025-04-08","release-2025-04-07","release-2025-04-04","release-2025-04-03","release-2025-04-02","release-2025-04-01","release-2025-03-31","release-2025-03-28","release-2025-03-27","release-2025-03-26","release-2025-03-25.2","release-2025-03-25","release-2025-03-21","release-2025-03-20","release-2025-03-19","release-2025-03-18","release-2025-03-17","release-2025-03-14","release-2025-03-13","release-2025-03-11","release-2025-03-10","release-2025-03-07","release-2025-03-06","release-2025-03-05","release-2025-03-04","release-2025-03-03","release-2025-02-28","release-2025-02-27","release-2025-02-26","release-2025-02-25","release-2025-02-24","release-2025-02-21","release-2025-02-20","release-2025-02-19","release-2025-02-18","release-2025-02-17","release-2025-02-14","release-2025-02-13","release-2025-02-12","release-2025-02-11","release-2025-02-10","release-2025-02-07","release-2025-02-06","release-2025-02-05","release-2025-02-04","release-2025-02-03","release-2025-01-31","release-2025-01-30","release-2025-01-29","release-2025-01-28","release-2025-01-27","release-2025-01-24","release-2025-01-23","release-2025-01-22","release-2025-01-21","release-2025-01-17","release-2025-01-16","release-2025-01-15","release-2025-01-14","release-2025-01-13","release-2025-01-10","release-2025-01-09","release-2025-01-08","release-2025-01-07","release-2025-01-06","release-2025-01-03","release-2025-01-02","release-2024-12-28","release-2024-12-27","release-2024-12-26","release-2024-12-23","release-2024-12-20","release-2024-12-19","release-2024-12-18.3","release-2024-12-18.2","release-2024-12-18","release-2024-12-13","release-2024-12-12","release-2024-12-11","release-2024-12-10","release-2024-12-09","release-2024-12-05","release-2024-12-04.2","release-2024-12-04","release-2024-12-03","release-2024-12-02","release-2024-11-27","release-2024-11-26","release-2024-11-25","release-2024-11-22","release-2024-11-21","release-2024-11-20","release-2024-11-19","release-2024-11-18","release-2024-11-15.2","release-2024-11-15","release-2024-11-14","release-2024-11-13","release-2024-11-12","release-2024-11-11","release-2024-11-08","release-2024-11-07","release-2024-11-06","release-2024-11-01","release-2024-10-31","release-2024-10-30","release-2024-10-29","release-2024-10-28","release-2024-10-25","release-2024-10-24","release-2024-10-23","release-2024-10-22","release-2024-10-21","release-2024-10-18","release-2024-10-17","release-2024-10-16","release-2024-10-15","release-2024-10-14","release-2024-10-11","release-2024-10-10","release-2024-10-09","release-2024-10-08","release-2024-10-07","release-2024-10-05","release-2024-10-03","release-2024-10-02","release-2024-10-01","release-2024-09-30","release-2024-09-28","release-2024-09-27","release-2024-09-26","release-2024-09-25","release-2024-09-24","release-2024-09-23","release-2024-09-20","release-2024-09-19","release-2024-09-18","release-2024-09-17","release-2024-09-16","release-2024-09-13","release-2024-09-12","release-2024-09-11","release-2024-09-10","release-2024-09-09","release-2024-09-06","release-2024-09-05","release-2024-09-04.3","release-2024-09-04.2","release-2024-09-04","release-2024-08-29","release-2024-08-28","release-2024-08-27","release-2024-08-26","release-2024-08-23","release-2024-08-22","release-2024-08-21","release-2024-08-20","release-2024-08-19","release-2024-08-16","release-2024-08-15","release-2024-08-14","release-2024-08-13","release-2024-08-12","release-2024-08-09","release-2024-08-08","release-2024-08-07","release-2024-08-06","release-2024-08-05","release-2024-08-02","release-2024-08-01","release-2024-07-30","release-2024-07-29","release-2024-07-25","release-2024-07-24","release-2024-07-23","release-2024-07-22","release-2024-07-18","release-2024-07-12","release-2024-07-10","release-2024-07-09","release-2024-07-08","release-2024-07-05","release-2024-07-03","release-2024-07-02","release-2024-07-01","release-2024-06-28","release-2024-06-27","release-2024-06-26","release-2024-06-25","release-2024-06-24","release-2024-06-20","release-2024-06-19","release-2024-06-18","release-2024-06-17","release-2024-06-14","release-2024-06-13","release-2024-06-12","release-2024-06-11.2","release-2024-06-11","release-2024-06-07","release-2024-06-06","release-2024-06-05","release-2024-06-04.2","release-2024-06-04","release-2024-05-31","release-2024-05-30.2","release-2024-05-30","release-2024-05-29","release-2024-05-24","release-2024-05-23","release-2024-05-22","release-2024-05-21","release-2024-05-20","release-2024-05-17","release-2024-05-16","release-2024-05-15","release-2024-05-14","release-2024-05-13","release-2024-05-10","release-2024-05-09","release-2024-05-08","release-2024-05-07","release-2024-05-06","release-2024-05-03","release-2024-05-02","release-2024-05-01","release-2024-04-30","release-2024-04-29","release-2024-04-26","release-2024-04-25","release-2024-04-24","release-2024-04-23","release-2024-04-22","release-2024-04-19","release-2024-04-18","release-2024-04-17","release-2024-04-16","release-2024-04-12","release-2024-04-11","release-2024-04-10","release-2024-04-09","release-2024-04-08","release-2024-04-05","release-2024-04-04","release-2024-04-03","release-2024-04-02","release-2024-04-01","release-2024-03-29","release-2024-03-28","release-2024-03-27","release-2024-03-26","release-2024-03-25","release-2024-03-22","release-2024-03-21","release-2024-03-20","release-2024-03-19","release-2024-03-18","release-2024-03-15","release-2024-03-14","release-2024-03-13","release-2024-03-12","release-2024-03-11","release-2024-03-08","release-2024-03-07","release-2024-03-06","release-2024-03-05","release-2024-03-04","release-2024-03-01","release-2024-02-29","release-2024-02-28","release-2024-02-27","release-2024-02-26","release-2024-02-23","release-2024-02-22.2","release-2024-02-22","release-2024-02-20","release-2024-02-19","release-2024-02-16","release-2024-02-15","release-2024-02-14","release-2024-02-13.2","release-2024-02-13","release-2024-02-09.2","release-2024-02-09","release-2024-02-07","release-2024-02-06","release-2024-02-05","release-2024-02-02","release-2024-02-01","release-2024-01-31","release-2024-01-30","release-2024-01-29","release-2024-01-26","release-2024-01-25","release-2024-01-24","release-2024-01-23","release-2024-01-22","release-2024-01-19","release-2024-01-18","release-2024-01-17","release-2024-01-16","release-2024-01-14","release-2024-01-12","release-2024-01-11","release-2024-01-10","release-2024-01-08","release-2024-01-05","release-2024-01-04","release-2024-01-03","release-2023-12-29","release-2023-12-28","release-2023-12-27","release-2023-12-26","release-2023-12-22","release-2023-12-21.2","release-2023-12-21","release-2023-12-19","release-2023-12-18","release-2023-12-15","release-2023-12-14","release-2023-12-13","release-2023-12-12","release-2023-12-11","release-2023-12-08","release-2023-12-07","release-2023-12-06","release-2023-12-05","release-2023-12-04","release-2023-12-01","release-2023-11-30.2","release-2023-11-30","release-2023-11-29","release-2023-11-28.2","release-2023-11-28","release-2023-11-27","release-2023-11-24","release-2023-11-22","release-2023-11-21","release-2023-11-20","release-2023-11-17","release-2023-11-16","release-2023-11-15","release-2023-11-14","release-2023-11-02","release-2023-10-26","release-2023-10-09","release-2023-10-06","release-2023-10-05","release-2023-10-04","release-2023-09-25","release-2023-09-22","release-2023-09-20","release-2023-09-19","release-2023-08-23","release-2023-08-03","release-2023-05-24","release-2023-05-01","release-2023-04-12","v0.11.0","v0.10.1","v0.9.0","v0.8.0","v0.7.0","v0.6.0","v0.4.1","v0.3.0","v0.2.0","release-2023-04-05","release-2023-03-30","release-2023-01-26","release-2023-01-13","release-2022-12-16","release-2022-12-15","release-2022-12-14","release-2022-10-26","release-2022-10-13","release-2022-09-21","release-2022-08-31","release-2022-08-08","release-2022-07-21","v0.15.0","v0.14.0","v0.13.0","v0.12.0","v0.10.0","v0.5.2","v0.5.1","v0.5.0","v0.4.0","v0.1.0","v0.0.26-alpha","v0.0.25-alpha","v0.0.24-alpha","v0.0.23-alpha","v0.0.22-alpha","v0.0.21-alpha","v0.0.20-alpha","v0.0.19-alpha","v0.0.18-alpha","v0.0.17-alpha","v0.0.16-alpha","v0.0.15-alpha","v0.0.14-alpha","v0.0.13-alpha","v0.0.12-alpha","v0.0.11-alpha","v0.0.10-alpha","v0.0.9-alpha","v0.0.8-alpha","v0.0.7-alpha","v0.0.6-alpha","v0.0.5-alpha","v0.0.4-alpha","v0.0.3-alpha","v0.0.2-alpha"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15957.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}