--- id: CVE-2026-18140 title: >- aws-smithy-json: aws-smithy-json: Denial of Service via uncontrolled recursion with deeply nested JSON (CVE-2026-18140) summary: >- A flaw was found in aws-smithy-json. This vulnerability allows a remote, unauthenticated attacker to cause a denial of service (DoS) in smithy-rs generated servers. By sending a small HTTP request containing deeply nested JSON, the attacke… severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' cvssSource: vendor cwe: - CWE-776 - CWE-674 vendor: Red Hat product: Red Hat Enterprise Linux Extensions Channel (v. 10) affected: - trusted_artifact_signer - trusted_profile_analyzer - enterprise_linux_extensions_channel_v_10 - enterprise_linux_extensions_channel_v_9 - logging_subsystem_for_red_hat_openshift 6.2 - logging_subsystem_for_red_hat_openshift 6.5 - logging_subsystem_for_red_hat_openshift 6.6 patched: - enterprise_linux_extensions_channel_v_10 - enterprise_linux_extensions_channel_v_9 - logging_subsystem_for_red_hat_openshift 6.2 - logging_subsystem_for_red_hat_openshift 6.5 - logging_subsystem_for_red_hat_openshift 6.6 published: '2026-07-30' updated: '2026-10-09' sourceUpdated: '2026-10-09T18:19:42+00:00' source: CSAF sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-18140.json' references: - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-18140.json - url: 'https://access.redhat.com/security/cve/CVE-2026-18140' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2509566' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-18140' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-18140' - url: 'https://aws.amazon.com/security/security-bulletins/2026-067-aws/' - url: 'https://crates.io/crates/aws-smithy-json/0.62.7' - url: >- https://github.com/smithy-lang/smithy-rs/security/advisories/GHSA-8ffr-xgwf-xj56 - url: 'https://access.redhat.com/errata/RHSA-2026:67593' - url: 'https://access.redhat.com/errata/RHSA-2026:67595' - url: 'https://access.redhat.com/errata/RHSA-2026:68349' - url: 'https://access.redhat.com/errata/RHSA-2026:70870' - url: 'https://access.redhat.com/errata/RHSA-2026:66521' - url: 'https://github.com/smithy-lang/smithy-rs/pull/4685' - url: >- https://github.com/smithy-lang/smithy-rs/commit/8f0882046c467981ba5b4fd91a10befa96bd262f - url: 'https://aws.amazon.com/security/security-bulletins/2026-067-aws' - url: 'https://github.com/smithy-lang/smithy-rs' - url: 'https://github.com/advisories/GHSA-8ffr-xgwf-xj56' tags: - csaf - vex - red-hat - osv - rust - ghsa epss: 0.00784 epssPercentile: 0.55852 aliases: - GHSA-8ffr-xgwf-xj56 ecosystem: rust ingestedAt: '2026-10-02T23:34:57.399Z' --- ## Overview A flaw was found in aws-smithy-json. This vulnerability allows a remote, unauthenticated attacker to cause a denial of service (DoS) in smithy-rs generated servers. By sending a small HTTP request containing deeply nested JSON, the attacker can trigger uncontrolled recursion in the aws-smithy-json runtime, leading to stack exhaustion and a process abort. This can make the affected server unavailable to legitimate users. ## Vendor advisories - **RHSA-2026:67593** · Red Hat · fixed in: Red Hat Enterprise Linux Extensions Channel (v. 10) · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67593) - **RHSA-2026:67595** · Red Hat · fixed in: Red Hat Enterprise Linux Extensions Channel (v. 9) · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67595) - **RHSA-2026:68349** · Red Hat · fixed in: Logging Subsystem for Red Hat OpenShift 6.2 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68349) - **RHSA-2026:70870** · Red Hat · fixed in: Logging Subsystem for Red Hat OpenShift 6.5 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:70870) - **RHSA-2026:66521** · Red Hat · fixed in: Logging Subsystem for Red Hat OpenShift 6.6 · released 2026-09-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:66521) - **Red Hat VEX** · Important · affected: Red Hat Trusted Artifact Signer, Red Hat Trusted Profile Analyzer · no fix planned: Red Hat Trusted Profile Analyzer, Red Hat Trusted Artifact Signer · updated 2026-10-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-18140.json) **aws-smithy-json: aws-smithy-json: Denial of Service via uncontrolled recursion with deeply nested JSON** — rated Important by Red Hat. Released 2026-07-30, updated 2026-10-09. Affected: - Red Hat Trusted Artifact Signer - Red Hat Trusted Profile Analyzer Fixed: - Red Hat Enterprise Linux Extensions Channel (v. 10) - Red Hat Enterprise Linux Extensions Channel (v. 9) - Logging Subsystem for Red Hat OpenShift 6.2 - Logging Subsystem for Red Hat OpenShift 6.5 - Logging Subsystem for Red Hat OpenShift 6.6 No fix planned: - Red Hat Trusted Profile Analyzer - Red Hat Trusted Artifact Signer Not affected: - Logging Subsystem for Red Hat OpenShift 6.2 - Logging Subsystem for Red Hat OpenShift 6.5 - Logging Subsystem for Red Hat OpenShift 6.6 - Confidential Compute Attestation - Red Hat Trusted Profile Analyzer ## Remediation Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:67593 Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:67595 For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/ocp-4-18-release-notes For Red Hat OpenShift Logging 6.2, see the following instructions to apply this update: https://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.2 https://access.redhat.com/errata/RHSA-2026:68349 Workarounds / mitigations: - Restrict network access to services that process JSON input using the `aws-smithy-json` runtime. Configure firewalls to limit incoming connections to trusted sources, thereby reducing the exposure to remote unauthenticated denial of service attacks. If the service is reloaded or restarted, ensure firewall rules persist. ## Package advisory (CVE-2026-18140) Affected packages: - `aws-smithy-json < 0.62.7` Patched in: - `aws-smithy-json 0.62.7` Source: https://osv.dev/vulnerability/GHSA-8ffr-xgwf-xj56