aws-smithy-http-server resource flaw enables unauthenticated Slowloris DoS in versions up to 0.66.4

A flaw in AWS Smithy-RS allows unauthenticated Slowloris denial of service attacks through unlimited resource allocation in the default server path. AWS Security Bulletins identified the vulnerability, assigned CVE-2026-16756, and published details on 23 July 2026. The issue resides in the default serve() path of the aws-smithy-http-server component, which handles incoming HTTP requests without imposing necessary limits on resource allocation.

Root cause

The vulnerability stems from how the default serve() path manages connections. According to the advisory, the component allocates resources without limits. This design choice allows for unauthenticated Slowloris denial of service. The framework, which generates HTTP clients and servers from Smithy interface definitions, powers the AWS SDK for Rust and custom service implementations. The lack of bounds on resource usage creates an opening for denial of service.

Attack path

The flaw allows unauthenticated Slowloris denial of service attacks. This method involves opening connections and sending them slowly to keep them open. The server, expecting complete requests, reserves resources for each partial connection. Because there are no limits on resource allocation, these connections accumulate. The source states the flaw allows this type of denial of service, but does not confirm active exploitation or specific consequences for legitimate traffic.

Affected versions

The following versions are impacted by CVE-2026-16756:

• aws-smithy-http-server version 0.66.4
• All earlier versions of aws-smithy-http-server

AWS states that the issue has been addressed in version 0.66.5. Teams using older versions must upgrade to secure their deployments.

Mitigation

• Upgrade aws-smithy-http-server to version 0.66.5 or later immediately.
• Ensure any forked or derivative code incorporates the new fixes.
• Verify that all service implementations using the framework are updated.
• Confirm that the serve() path in your configuration is using the patched version.

Why it matters

Teams usually manage server capacity by tracking active connections and resource usage. Without limits, a single attacker can monopolise server threads, blocking legitimate users. Check whether your services expose default server paths to untrusted networks. Review configurations to ensure resource allocation is bounded. This incident highlights the risk of unauthenticated endpoints in server frameworks. Security operations should monitor for unusual connection patterns that indicate slow, persistent requests.

What to do and how to stay safe: AWS

• Audit your infrastructure for any use of aws-smithy-http-server version 0.66.4 or earlier.
• Plan an upgrade to version 0.66.5, ensuring testing in non-production environments first.
• Monitor server logs for signs of Slowloris attacks, such as many incomplete connections.
• Review network configurations to restrict access to server endpoints where possible.

Step-by-step guide: Security Advisories: 6 Common Misreadings That Leave Systems Exposed

General security guidance from the Vector Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-16756?

CVE-2026-16756 is a vulnerability in aws-smithy-http-server that allows unauthenticated Slowloris denial of service attacks through unlimited resource allocation.

Which versions are affected?

All versions of aws-smithy-http-server up to and including 0.66.4 are affected by this issue.

Is there a workaround?

No, AWS states there is no workaround besides upgrading to the patched version 0.66.5.