Smithy‑RS generates HTTP clients and servers from Smithy interface definitions, and the deserializer functions for JSON, CBOR, and XML contain uncontrolled recursion. When a remote attacker sends a small request with a deeply nested recursive model shape, the deserializer can exhaust the process stack and cause the target application to abort. The failure results in a denial of service and does not require authentication.

The AWS SDK for Rust (aws-sdk‑rust) is vulnerable in all releases prior to release‑2026‑06‑02. Any application that imports the vulnerable SDK can be impacted. Additionally, applications that use smithy‑rs code generation to build custom servers are affected if the code was generated from smithy‑rs releases older than release‑2026‑06‑01.

The stored CVSS score of 8.7 classifies the issue as high severity, and the EPSS score of less than 1 % indicates a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a crafted request containing a recursive shape and can be performed over any reachable network interface; authentication is not required. The combination of remote attack vector, denial of service impact, and the lack of mitigations in the vulnerable code creates a high risk for exposed services.