Uncontrolled recursion in Smithy‑RS generated JSON, CBOR, and XML deserializers can cause a remote attacker to trigger a denial of service by sending a small request with deeply nested data for a recursive model shape. The recursion leads to stack exhaustion and process termination. This weakness is categorized as Resource Exhaustion (CWE‑770) and presents a high‑severity vulnerability.

The vulnerability affects the AWS SDK for Rust (aws-sdk-rust). No specific SDK version range is listed, but the issue originates from code generated by Smithy‑RS. Custom server implementations that use Smithy‑RS code generation are also impacted.

The CVSS score is 8.7, indicating a serious impact. The EPSS score is below 1 %, suggesting a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a crafted request containing recursive shapes and does not need authentication, so the attack vector inferred is remote over the network. The risk is high due to the denial of service potential, but the limited exploitation conditions and low EPSS moderate overall threat urgency.