{"items":[{"id":"NVI-00015302","kind":"vulnerability","title":"Smithy-RS: Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-jvxp-qmx7-gjpx","CVE-2026-16756"],"plain_summary":"GitHub lists this reviewed advisory for aws-smithy-http-server. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-57c9d3db39614cc27122fec998662150"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-07-24T22:37:39.000Z","value":"7.5 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-57c9d3db39614cc27122fec998662150"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-57c9d3db39614cc27122fec998662150","url":"https://github.com/advisories/GHSA-jvxp-qmx7-gjpx","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-jvxp-qmx7-gjpx","publisher":"GitHub Advisory Database","observed_at":"2026-11-03T09:59:04.660Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-57c9d3db39614cc27122fec998662150"],"technology":"aws-smithy-http-server","known_exclusions":[],"conditions_summary":"## Summary\nSmithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations. An issue exists where, under certain circumstances, allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service. \n\n## Impact\nMissing connection and header-read timeouts and the absence of a concurrent-connection cap in the default serve() path of Amazon aws-smithy-http-server might allow remote attackers to cause a denial of service by opening many connections and sending partial requests that are never completed, exhausting server sockets and tasks.\n\nImpacted versions: aws-smithy-http-server <= 0.66.4\n\n## Patches\nThis issue has been addressed in aws-smithy-http-server version 0.66.5. AWS recommends upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\n## Workarounds\nThere is no workaround besides updating to the patched version.\n\n## Contact\nIf you have any questions or comments about this advisory, AWS asks that you contact AWS Secur","public_affected_ranges":["<= 0.66.4"]}],"null_published_at":"2026-11-03T10:03:26.568Z","source_updated_at":"2026-07-24T22:37:39.000Z","source_disclosed_at":"2026-07-24T22:37:39.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-03T09:59:04.660Z"}],"next_cursor":null,"snapshot_revision":"42594"}