aws-smithy-json: Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers

What happened?

Summary Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations. An issue exists which allows uncontrolled recursion in the unknown-key skip path of the Amazon aws-smithy-json runtime crate in versions 0.62.6 and earlier. Impact Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which the smithy

Key details

• Uncontrolled recursion exists in the unknown-key skip path of aws-smithy-json crate.
• Remote unauthenticated attackers can trigger denial of service with a single small HTTP request.
• Attack uses deeply nested JSON sent to a smithy-rs generated server endpoint.
• The weakness is classified as CWE-674 uncontrolled recursion consuming stack resources.
• No workarounds exist other than upgrading to the patched version.

Summarised by SecOraLens from GitHub Security Advisories. Always read the original source before acting. How SecOraLens verifies advisories.