CVE-2026-16756: aws-smithy-http-server, отказ на услуга

Описание

Оригинално описание

Missing connection and header-read timeouts and the absence of a concurrent-connection cap in the default serve() path of Amazon aws-smithy-http-server might allow remote attackers to cause a denial of service by opening many connections and sending partial requests that are never completed, exhausting server sockets and tasks. To mitigate this issue, users should upgrade to aws-smithy-http-server 0.66.5 or later.

Засегнати продукти

• AWS aws-smithy-http-server: до 0.66.4

Вид слабост

• CWE-770 Allocation of Resources Without Limits or Throttling

История

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-16756
• https://nvd.nist.gov/vuln/detail/CVE-2026-16756
• https://crates.io/crates/aws-smithy-http-server/0.66.5
• https://aws.amazon.com/security/security-bulletins/2026-064-aws/
• https://github.com/smithy-lang/smithy-rs/security/advisories/GHSA-jvxp-qmx7-gjpx