Skip to content
OpenAdvisories
High ALAS2023-2026-3333 1 CVE

Important: amazon-efs-utils security update (Amazon Linux 2023)

Published Oct 26, 2026 · Updated Oct 26, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-15957: Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations. Uncontrolled recursion in the JSON, CBOR, and XML deserializer functions emitted by Amazon smithy-rs code generation could allow remote attackers to cause a denial of service (process abort via stack exhaustion) via a small request containing deeply nested data for a recursive model shape to a generated SDK or server. To mitigate this issue, users should upgrade to aws-sdk-rust release-2026-06-02 or later. Users building custom servers with smithy-rs codegen should regenerate from smithy-rs release-2026-06-01 or later.

Fixed packages 1

ReleasePackageFixed in
Amazon Linux · 2023 amazon-efs-utils 0:3.1.3-1.amzn2023

Vulnerabilities 1

  • High 7.5
    CVE-2026-15957

    Uncontrolled recursion in smithy-rs generated JSON, CBOR, and XML deserializers allows unauthenticated remote denial of service via recursive shapes

    Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations. Uncontrolled recursion in the JSON, CBOR, and XML deserializ…

    AWS aws-sdk-rust

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-15957.html