DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-16756: CVE-2026-16756: Slowloris Denial of Service via Resource Exhaustion in aws-smithy-http-server

#security #cve #cybersecurity

CVE-2026-16756: Slowloris Denial of Service via Resource Exhaustion in aws-smithy-http-server

Vulnerability ID: CVE-2026-16756
CVSS Score: 7.5
Published: 2026-07-24

An unauthenticated remote resource exhaustion vulnerability in Amazon aws-smithy-http-server enables denial-of-service (DoS) attacks. Affected versions do not enforce connection limits or header timeouts, allowing standard Slowloris techniques to block server operations.

TL;DR

Unauthenticated attackers can exhaust server connections and task buffers in Amazon aws-smithy-http-server by maintaining slow, partial HTTP request streams, leading to a complete denial-of-service condition.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-770 (Allocation of Resources Without Limits or Throttling)
  • Attack Vector: Network
  • CVSS: 7.5 (High)
  • EPSS Score: 0.00417 (34.15th Percentile)
  • Impact: Denial of Service (DoS) via resource exhaustion
  • Exploit Status: Proof-of-Concept / Theoretical
  • KEV Status: Not Listed

Affected Systems

  • AWS Smithy Runtime Systems
  • Rust Microservices utilizing smithy-rs server generation
  • Deployments running stand-alone aws-smithy-http-server binaries
  • aws-smithy-http-server: <= 0.66.4 (Fixed in: 0.66.5)

Mitigation Strategies

  • Upgrade the aws-smithy-http-server library dependency to version 0.66.5 or later.
  • Place a dedicated reverse proxy (NGINX, HAProxy) or Application Load Balancer in front of the application.
  • Apply localized connection limits and header timeouts using custom Tower or Tokio middleware stack configurations.

Remediation Steps:

  1. Open Cargo.toml within the Rust workspace containing the Smithy server logic.
  2. Update the dependency version of aws-smithy-http-server to "0.66.5" or newer.
  3. Run cargo update to download the patched crate version and rebuild the application binary.
  4. Validate the fix locally by setting a low connection timeout and observing server response to incomplete headers.

References

Read the full report for CVE-2026-16756 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)