A missing connection and header‑read timeout, coupled with no limit on concurrent connections in the default serve() entry point of aws-smithy-http-server, can let an unauthenticated remote attacker open many long‑lived connections and send incomplete requests that are never finished. The server is forced to keep these sockets and processing tasks active, eventually exhausting available resources such as sockets and worker threads and rendering the service unavailable. The weakness is a classic resource exhaustion flaw (CWE‑770).

The vulnerability affects the AWS aws‑smithy‑http‑server component. Any installation of aws‑smithy‑http‑server that is older than version 0.66.5 is susceptible because the patch that introduces connection limits and read timeouts is included only in 0.66.5 and later releases.

The CVSS score of 8.7 classifies the issue as high severity. Because the EPSS score is below 1 %, the likelihood of an attack at this time is low, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the attack vector is remote, does not require authentication, and can be launched against publicly exposed services that use the default serve() path. If successful, it can cause a loss of availability for the affected service, which could impact any user or downstream system relying on it.