{"action":"Upgrade aws-smithy-http-server to 0.66.5 or later.","affected":[{"fixed":"0.66.5","introduced":"0"}],"component":"aws-smithy-http-server","cve_ids":["CVE-2026-16756"],"ecosystem":"crates.io","epss":0.0075,"exploited":false,"fixed_versions":["0.66.5"],"ghsa_id":"GHSA-jvxp-qmx7-gjpx","id":"tcs_01M5KF1A32NKQ63Z4996G47CRB","modified_at":"2026-07-24T22:56:43.598373Z","published_at":"2026-07-24T22:37:39Z","references":["https://osv.dev/vulnerability/GHSA-jvxp-qmx7-gjpx","https://github.com/smithy-lang/smithy-rs/security/advisories/GHSA-jvxp-qmx7-gjpx","https://nvd.nist.gov/vuln/detail/CVE-2026-16756","https://aws.amazon.com/security/security-bulletins/2026-064-aws","https://crates.io/crates/aws-smithy-http-server/0.66.5","https://github.com/smithy-lang/smithy-rs"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-jvxp-qmx7-gjpx","url":"https://osv.dev/vulnerability/GHSA-jvxp-qmx7-gjpx"}],"summary":"Smithy-RS: Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service"}