Orgs urged to patch AWS Smithy-RS 0.66.5 to block unauthenticated Slowloris DoS in Rust servers
An unauthenticated denial-of-service vulnerability in AWS Smithy-RS affects versions through 0.66.4, with a fix available in version 0.66.5.
Key points
- CVE-2026-16756 allows resource exhaustion via Slowloris attacks in default server paths.
- Impacted systems include aws-smithy-http-server versions 0.66.4 and earlier.
- AWS released version 0.66.5 to address the issue, with no other workaround available.
Organisations running AWS Smithy-RS HTTP servers must upgrade to version 0.66.5 immediately to stop unauthenticated denial-of-service attacks. The flaw, tracked as CVE-2026-16756, exists in the default serve() path of aws-smithy-http-server versions through 0.66.4. AWS Security Bulletins published this advisory on July 23, 2026, classifying the issue as important. The framework powers the AWS SDK for Rust and custom service implementations.
How it unfolded
- AWS identified that the default aws-smithy-http-server serve() path allocates resources without limits.
- This lack of limits allows attackers to perform unauthenticated Slowloris denial-of-service attacks.
- AWS released version 0.66.5 to patch the vulnerability and recommended immediate upgrades.
Who is affected
Any system using aws-smithy-http-server version 0.66.4 or earlier is vulnerable. This includes applications built with the AWS SDK for Rust and custom services generated from Smithy interface definitions. The issue allows attackers to exhaust server resources without authentication. AWS states that forked or derivative code must also be patched to incorporate the new fixes. There is no workaround besides upgrading to the patched version.
Our take on the response
AWS acted quickly to address the resource allocation flaw in its Rust framework. By releasing version 0.66.5, the vendor provides a direct fix for the Slowloris vulnerability. The advisory clearly identifies the impacted versions and the specific function involved. Teams should verify their dependency trees to ensure all components are updated. The lack of a workaround means upgrading is the only option to secure affected systems.
Who needs to act first
Teams usually prioritise internet-facing services when patching denial-of-service flaws. Check whether your production environments expose the default aws-smithy-http-server serve() path to external traffic. Test the upgrade in a staging environment first to ensure compatibility with your custom service implementations. Back up your current configuration before applying the update. If you cannot upgrade immediately, consider restricting access to the affected endpoints using network-level controls to reduce exposure while you prepare the rollout.
What to do and how to stay safe: AWS
- Audit your Rust service dependencies to identify any instances of aws-smithy-http-server version 0.66.4 or earlier.
- Upgrade affected services to version 0.66.5 as soon as possible to apply the vendor-provided fix.
- Review firewall rules and network access controls to limit exposure of unauthenticated HTTP endpoints.
- Monitor server resource usage for signs of abnormal connection patterns that may indicate Slowloris attacks.
Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time
General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-16756?
It is a vulnerability in aws-smithy-http-server that allows unauthenticated Slowloris denial-of-service attacks due to unlimited resource allocation.
Which versions are affected?
aws-smithy-http-server versions 0.66.4 and earlier are impacted by this issue.
Is there a workaround?
No, AWS states there is no workaround besides upgrading to the patched version 0.66.5.
