{"action":"Upgrade aws-smithy-json to 0.62.7 or later.","affected":[{"fixed":"0.62.7","introduced":"0"}],"component":"aws-smithy-json","cve_ids":["CVE-2026-18140"],"ecosystem":"crates.io","epss":0.00784,"exploited":false,"fixed_versions":["0.62.7"],"ghsa_id":"GHSA-8ffr-xgwf-xj56","id":"tcs_01M5KEVRZ5K13QDSPXMY2CV3Q6","modified_at":"2026-10-02T23:01:22.700563746Z","published_at":"2026-10-02T22:44:52Z","references":["https://osv.dev/vulnerability/GHSA-8ffr-xgwf-xj56","https://github.com/smithy-lang/smithy-rs/security/advisories/GHSA-8ffr-xgwf-xj56","https://nvd.nist.gov/vuln/detail/CVE-2026-18140","https://github.com/smithy-lang/smithy-rs/pull/4685","https://github.com/smithy-lang/smithy-rs/commit/8f0882046c467981ba5b4fd91a10befa96bd262f","https://aws.amazon.com/security/security-bulletins/2026-067-aws","https://crates.io/crates/aws-smithy-json/0.62.7","https://github.com/smithy-lang/smithy-rs"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-8ffr-xgwf-xj56","url":"https://osv.dev/vulnerability/GHSA-8ffr-xgwf-xj56"}],"summary":"aws-smithy-json: Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers"}