CVE-2026-16756: Smithy-RS: Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service

July 24, 2026

Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations. An issue exists where, under certain circumstances, allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service.

References

aws.amazon.com/security/security-bulletins/2026-064-aws
crates.io/crates/aws-smithy-http-server/0.66.5
github.com/advisories/GHSA-jvxp-qmx7-gjpx
github.com/smithy-lang/smithy-rs/security/advisories/GHSA-jvxp-qmx7-gjpx
nvd.nist.gov/vuln/detail/CVE-2026-16756

Code Behaviors & Features

Detect and mitigate CVE-2026-16756 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →