CVE-2026-16756

HIGH

AWS aws-smithy-http-server < 0.66.5 - Unauthenticated Slowloris Denial of Service

Title source: manual

Description

Missing connection and header-read timeouts and the absence of a concurrent-connection cap in the default serve() path of Amazon aws-smithy-http-server might allow remote attackers to cause a denial of service by opening many connections and sending partial requests that are never completed, exhausting server sockets and tasks. To mitigate this issue, users should upgrade to aws-smithy-http-server 0.66.5 or later.

References (3)

Core 3

Core References

Patch release-notes patch

https://crates.io/crates/aws-smithy-http-server/0.66.5

Vendor Advisory vendor-advisory

https://aws.amazon.com/security/security-bulletins/2026-064-aws/

Release Notes release-notes

https://github.com/smithy-lang/smithy-rs/security/advisories/GHSA-jvxp-qmx7-gjpx

Scores

CVSS v3 7.5

EPSS 0.0042

EPSS Percentile 34.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-770

Status published

Products (2)

AWS/aws-smithy-http-server < 0.66.4

crates.io/aws-smithy-http-server 0 - 0.66.5crates.io

Published Jul 23, 2026

Tracked Since Jul 24, 2026