AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

AWSAWS-2026-064

Allocation of resources without limits in the default aws-smithy-http-server serve() path...

AWS

CVE-2026-16756 · Published Oct 19, 2026

High7.5
No fix yet
AWS advisory

Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service

Affected versions

The source does not list versions here. See the source advisory for affected products and fixes.

Changes since it was listed

SeverityOct 7Severity: Unrated to High
Details and references
Severity from
NVD

More AWS advisories

All AWS
Medium 6.5Oct 19Credential disclosure in Strands Agents Tools elasticsearch_memory toolCVE-2026-15746no fix yetMedium 6.5Oct 19Issues with s2n-tls: an open-source implementation of the TLS/SSL protocolsCVE-2026-16317no fix yetMedium 5.7Oct 19Sensitive content disclosure via OpenTelemetry spans in AgentCore Python SDKCVE-2026-15737no fix yetHigh 7.5Oct 19Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows...CVE-2026-18140no fix yetHigh 7.8Oct 19OS command injection in jsii-diff in AWS jsiiCVE-2026-15895no fix yetHigh 7.3Oct 19Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK...CVE-2026-16796no fix yet