high7.5
CVE-2026-16756
Missing connection and header-read timeouts and the absence of a concurrent-connection cap in the default serve() path of Amazon aws-smithy-http-server might a…
Impact
Missing connection and header-read timeouts and the absence of a concurrent-connection cap in the default serve() path of Amazon aws-smithy-http-server might allow remote attackers to cause a denial of service by opening many connections and sending partial requests that are never completed, exhausting server sockets and tasks. To mitigate this issue, users should upgrade to aws-smithy-http-server 0.66.5 or later.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rust | aws-smithy-http-server | <= 0.66.4 | 0.66.5 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-jvxp-qmx7-gjpx
- https://github.com/smithy-lang/smithy-rs/security/advisories/GHSA-jvxp-qmx7-gjpx
- https://nvd.nist.gov/vuln/detail/CVE-2026-16756
- https://aws.amazon.com/security/security-bulletins/2026-064-aws
- https://crates.io/crates/aws-smithy-http-server/0.66.5
- https://aws.amazon.com/security/security-bulletins/2026-064-aws/