{"id":"CVE-2026-18140","title":"aws-smithy-json: aws-smithy-json: Denial of Service via uncontrolled recursion with deeply nested JSON (CVE-2026-18140)","summary":"A flaw was found in aws-smithy-json. This vulnerability allows a remote, unauthenticated attacker to cause a denial of service (DoS) in smithy-rs generated servers. By sending a small HTTP request containing deeply nested JSON, the attacke…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":["CWE-776","CWE-674"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux Extensions Channel (v. 10)","affected":["trusted_artifact_signer","trusted_profile_analyzer","enterprise_linux_extensions_channel_v_10","enterprise_linux_extensions_channel_v_9","logging_subsystem_for_red_hat_openshift 6.2","logging_subsystem_for_red_hat_openshift 6.5","logging_subsystem_for_red_hat_openshift 6.6"],"patched":["enterprise_linux_extensions_channel_v_10","enterprise_linux_extensions_channel_v_9","logging_subsystem_for_red_hat_openshift 6.2","logging_subsystem_for_red_hat_openshift 6.5","logging_subsystem_for_red_hat_openshift 6.6"],"published":"2026-07-30","updated":"2026-10-09","sourceUpdated":"2026-10-09T18:19:42+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-18140.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-18140.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-18140"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509566"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18140"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18140"},{"url":"https://aws.amazon.com/security/security-bulletins/2026-067-aws/"},{"url":"https://crates.io/crates/aws-smithy-json/0.62.7"},{"url":"https://github.com/smithy-lang/smithy-rs/security/advisories/GHSA-8ffr-xgwf-xj56"},{"url":"https://access.redhat.com/errata/RHSA-2026:67593"},{"url":"https://access.redhat.com/errata/RHSA-2026:67595"},{"url":"https://access.redhat.com/errata/RHSA-2026:68349"},{"url":"https://access.redhat.com/errata/RHSA-2026:70870"},{"url":"https://access.redhat.com/errata/RHSA-2026:66521"},{"url":"https://github.com/smithy-lang/smithy-rs/pull/4685"},{"url":"https://github.com/smithy-lang/smithy-rs/commit/8f0882046c467981ba5b4fd91a10befa96bd262f"},{"url":"https://aws.amazon.com/security/security-bulletins/2026-067-aws"},{"url":"https://github.com/smithy-lang/smithy-rs"},{"url":"https://github.com/advisories/GHSA-8ffr-xgwf-xj56"}],"tags":["csaf","vex","red-hat","osv","rust","ghsa"],"epss":0.00784,"epssPercentile":0.55852,"aliases":["GHSA-8ffr-xgwf-xj56"],"ecosystem":"rust","ingestedAt":"2026-10-02T23:34:57.399Z","slug":"CVE-2026-18140","body":"## Overview\n\nA flaw was found in aws-smithy-json. This vulnerability allows a remote, unauthenticated attacker to cause a denial of service (DoS) in smithy-rs generated servers. By sending a small HTTP request containing deeply nested JSON, the attacker can trigger uncontrolled recursion in the aws-smithy-json runtime, leading to stack exhaustion and a process abort. This can make the affected server unavailable to legitimate users.\n\n## Vendor advisories\n\n- **RHSA-2026:67593** · Red Hat · fixed in: Red Hat Enterprise Linux Extensions Channel (v. 10) · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67593)\n- **RHSA-2026:67595** · Red Hat · fixed in: Red Hat Enterprise Linux Extensions Channel (v. 9) · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67595)\n- **RHSA-2026:68349** · Red Hat · fixed in: Logging Subsystem for Red Hat OpenShift 6.2 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68349)\n- **RHSA-2026:70870** · Red Hat · fixed in: Logging Subsystem for Red Hat OpenShift 6.5 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:70870)\n- **RHSA-2026:66521** · Red Hat · fixed in: Logging Subsystem for Red Hat OpenShift 6.6 · released 2026-09-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:66521)\n- **Red Hat VEX** · Important · affected: Red Hat Trusted Artifact Signer, Red Hat Trusted Profile Analyzer · no fix planned: Red Hat Trusted Profile Analyzer, Red Hat Trusted Artifact Signer · updated 2026-10-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-18140.json)\n\n**aws-smithy-json: aws-smithy-json: Denial of Service via uncontrolled recursion with deeply nested JSON** — rated Important by Red Hat. Released 2026-07-30, updated 2026-10-09.\n\nAffected:\n\n- Red Hat Trusted Artifact Signer\n- Red Hat Trusted Profile Analyzer\n\nFixed:\n\n- Red Hat Enterprise Linux Extensions Channel (v. 10)\n- Red Hat Enterprise Linux Extensions Channel (v. 9)\n- Logging Subsystem for Red Hat OpenShift 6.2\n- Logging Subsystem for Red Hat OpenShift 6.5\n- Logging Subsystem for Red Hat OpenShift 6.6\n\nNo fix planned:\n\n- Red Hat Trusted Profile Analyzer\n- Red Hat Trusted Artifact Signer\n\nNot affected:\n\n- Logging Subsystem for Red Hat OpenShift 6.2\n- Logging Subsystem for Red Hat OpenShift 6.5\n- Logging Subsystem for Red Hat OpenShift 6.6\n- Confidential Compute Attestation\n- Red Hat Trusted Profile Analyzer\n\n## Remediation\n\nBefore applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:67593\nBefore applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:67595\nFor OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/ocp-4-18-release-notes\n\nFor Red Hat OpenShift Logging 6.2, see the following instructions to apply this update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.2 https://access.redhat.com/errata/RHSA-2026:68349\n\nWorkarounds / mitigations:\n\n- Restrict network access to services that process JSON input using the `aws-smithy-json` runtime. Configure firewalls to limit incoming connections to trusted sources, thereby reducing the exposure to remote unauthenticated denial of service attacks. If the service is reloaded or restarted, ensure firewall rules persist.\n\n## Package advisory (CVE-2026-18140)\n\nAffected packages:\n\n- `aws-smithy-json < 0.62.7`\n\nPatched in:\n\n- `aws-smithy-json 0.62.7`\n\nSource: https://osv.dev/vulnerability/GHSA-8ffr-xgwf-xj56","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}