3.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-g59m-gf8j-gjf5

GHSA-g59m-gf8j-gjf5: AWS SDK for Rust v1 adopted defense in depth enhancement for region parameter value

Summary

This notification is related to the use of specific values for the region input field when calling AWS services. An actor with access to the environment in which the SDK is used could set the region input field to an invalid value.

A defense-in-depth enhancement has been implemented in the AWS SDK for Rust. This enhancement validates that a region used to construct an endpoint URL is a valid host label. The change was released on November 6, 2025. This advisory is informational to help customers understand their responsibilities regarding configuration security.

Impact

Customer applications could be configured to improperly route AWS API calls to non-existent or non-AWS hosts. While the SDK was functioning safely within the requirements of the shared responsibility model, additional safeguards have been added to support secure customer implementations.

Impacted versions: All versions prior to November 6, 2025 release

Patches

On November 6, 2025, an enhancement [1] was made to the AWS SDK for Rust release, which validates the formatting of a region, providing additional safeguards.

Workarounds

No workarounds are needed, but as always developers should ensure that their application is following security best practices:

Implement proper input validation in your application code
Update to the latest AWS SDK for Rust release on a regular basis
Follow AWS security best practices [2] for SDK configuration

References

Contact AWS Security via the vulnerability reporting page or email aws-security@amazon.com.

Acknowledgement

AWS Security thanks Guy Arazi for bringing these customer security considerations to our attention through the coordinated disclosure process.

[1] https://github.com/smithy-lang/smithy-rs/pull/4383 [2] https://docs.aws.amazon.com/sdk-for-rust/latest/dg/security.html

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-g59m-gf8j-gjf5

GHSA-g59m-gf8j-gjf5:

3.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
aws-sdk-accessanalyzer	rust	< 1.96.0	1.96.0
aws-sdk-account	rust	< 1.92.0	1.92.0
aws-sdk-acm	rust	< 1.92.0	1.92.0
aws-sdk-acmpca	rust	< 1.94.0	1.94.0
aws-sdk-aiops	rust	< 1.18.0	1.18.0
aws-sdk-amp	rust	< 1.95.0	1.95.0
aws-sdk-amplify	rust	< 1.98.0	1.98.0
aws-sdk-amplifybackend	rust	< 1.89.0	1.89.0
aws-sdk-amplifyuibuilder	rust	< 1.89.0	1.89.0
aws-sdk-apigateway	rust	< 1.92.0	1.92.0
aws-sdk-apigatewaymanagement	rust	< 1.89.0	1.89.0
aws-sdk-apigatewayv2	rust	< 1.91.0	1.91.0
aws-sdk-appconfig	rust	< 1.94.0	1.94.0
aws-sdk-appconfigdata	rust	< 1.89.0	1.89.0
aws-sdk-appfabric	rust	< 1.89.0	1.89.0
aws-sdk-appflow	rust	< 1.89.0	1.89.0
aws-sdk-appintegrations	rust	< 1.90.0	1.90.0
aws-sdk-applicationautoscaling	rust	< 1.95.0	1.95.0
aws-sdk-applicationcostprofiler	rust	< 1.89.0	1.89.0
aws-sdk-applicationdiscovery	rust	< 1.91.0	1.91.0
aws-sdk-applicationinsights	rust	< 1.90.0	1.90.0
aws-sdk-applicationsignals	rust	< 1.67.0	1.67.0
aws-sdk-appmesh	rust	< 1.89.0	1.89.0
aws-sdk-apprunner	rust	< 1.90.0	1.90.0
aws-sdk-appstream	rust	< 1.95.0	1.95.0
aws-sdk-appsync	rust	< 1.102.0	1.102.0
aws-sdk-arcregionswitch	rust	< 1.9.0	1.9.0
aws-sdk-arczonalshift	rust	< 1.93.0	1.93.0
aws-sdk-artifact	rust	< 1.79.0	1.79.0
aws-sdk-athena	rust	< 1.94.0	1.94.0
aws-sdk-auditmanager	rust	< 1.93.0	1.93.0
aws-sdk-autoscaling	rust	< 1.100.0	1.100.0
aws-sdk-autoscalingplans	rust	< 1.89.0	1.89.0
aws-sdk-b2bi	rust	< 1.96.0	1.96.0
aws-sdk-backup	rust	< 1.96.0	1.96.0
aws-sdk-backupgateway	rust	< 1.89.0	1.89.0
aws-sdk-backupsearch	rust	< 1.38.0	1.38.0
aws-sdk-batch	rust	< 1.100.0	1.100.0
aws-sdk-bcmdashboards	rust	< 1.7.0	1.7.0
aws-sdk-bcmdataexports	rust	< 1.86.0	1.86.0
aws-sdk-bcmpricingcalculator	rust	< 1.44.0	1.44.0
aws-sdk-bcmrecommendedactions	rust	< 1.7.0	1.7.0
aws-sdk-bedrock	rust	< 1.120.0	1.120.0
aws-sdk-bedrockagent	rust	< 1.119.0	1.119.0
aws-sdk-bedrockagentcore	rust	< 1.17.0	1.17.0
aws-sdk-bedrockagentcorecontrol	rust	< 1.21.0	1.21.0
aws-sdk-bedrockagentruntime	rust	< 1.116.0	1.116.0
aws-sdk-bedrockdataautomation	rust	< 1.42.0	1.42.0
aws-sdk-bedrockdataautomationruntime	rust	< 1.40.0	1.40.0
aws-sdk-bedrockruntime	rust	< 1.113.0	1.113.0
aws-sdk-billing	rust	< 1.43.0	1.43.0
aws-sdk-billingconductor	rust	< 1.90.0	1.90.0
aws-sdk-braket	rust	< 1.92.0	1.92.0
aws-sdk-budgets	rust	< 1.96.0	1.96.0
aws-sdk-chatbot	rust	< 1.79.0	1.79.0
aws-sdk-chime	rust	< 1.90.0	1.90.0
aws-sdk-chimesdkidentity	rust	< 1.89.0	1.89.0
aws-sdk-chimesdkmediapipelines	rust	< 1.91.0	1.91.0
aws-sdk-chimesdkmeetings	rust	< 1.91.0	1.91.0
aws-sdk-chimesdkmessaging	rust	< 1.90.0	1.90.0
aws-sdk-chimesdkvoice	rust	< 1.93.0	1.93.0
aws-sdk-cleanrooms	rust	< 1.107.0	1.107.0
aws-sdk-cleanroomsml	rust	< 1.93.0	1.93.0
aws-sdk-cloud9	rust	< 1.90.0	1.90.0
aws-sdk-cloudcontrol	rust	< 1.90.0	1.90.0
aws-sdk-clouddirectory	rust	< 1.89.0	1.89.0
aws-sdk-cloudformation	rust	< 1.99.0	1.99.0
aws-sdk-cloudfront	rust	< 1.102.0	1.102.0
aws-sdk-cloudfrontkeyvaluestore	rust	< 1.88.0	1.88.0
aws-sdk-cloudhsm	rust	< 1.89.0	1.89.0
aws-sdk-cloudhsmv2	rust	< 1.92.0	1.92.0
aws-sdk-cloudsearch	rust	< 1.89.0	1.89.0
aws-sdk-cloudsearchdomain	rust	< 1.89.0	1.89.0
aws-sdk-cloudtrail	rust	< 1.96.0	1.96.0
aws-sdk-cloudtraildata	rust	< 1.89.0	1.89.0
aws-sdk-cloudwatch	rust	< 1.97.0	1.97.0
aws-sdk-cloudwatchevents	rust	< 1.89.0	1.89.0
aws-sdk-cloudwatchlogs	rust	< 1.107.0	1.107.0
aws-sdk-codeartifact	rust	< 1.92.0	1.92.0
aws-sdk-codebuild	rust	< 1.113.0	1.113.0
aws-sdk-codecatalyst	rust	< 1.89.0	1.89.0
aws-sdk-codecommit	rust	< 1.90.0	1.90.0
aws-sdk-codeconnections	rust	< 1.73.0	1.73.0
aws-sdk-codedeploy	rust	< 1.91.0	1.91.0
aws-sdk-codeguruprofiler	rust	< 1.89.0	1.89.0
aws-sdk-codegurureviewer	rust	< 1.89.0	1.89.0
aws-sdk-codegurusecurity	rust	< 1.89.0	1.89.0
aws-sdk-codepipeline	rust	< 1.99.0	1.99.0
aws-sdk-codestarconnections	rust	< 1.91.0	1.91.0
aws-sdk-codestarnotifications	rust	< 1.89.0	1.89.0
aws-sdk-cognitoidentity	rust	< 1.90.0	1.90.0
aws-sdk-cognitoidentityprovider	rust	< 1.103.0	1.103.0
aws-sdk-cognitosync	rust	< 1.89.0	1.89.0
aws-sdk-comprehend	rust	< 1.89.0	1.89.0
aws-sdk-comprehendmedical	rust	< 1.89.0	1.89.0
aws-sdk-computeoptimizer	rust	< 1.93.0	1.93.0
aws-sdk-config	rust	< 1.94.0	1.94.0
aws-sdk-connect	rust	< 1.136.0	1.136.0
aws-sdk-connectcampaigns	rust	< 1.91.0	1.91.0
aws-sdk-connectcampaignsv2	rust	< 1.41.0	1.41.0
aws-sdk-connectcases	rust	< 1.97.0	1.97.0
aws-sdk-connectcontactlens	rust	< 1.91.0	1.91.0
aws-sdk-connectparticipant	rust	< 1.93.0	1.93.0
aws-sdk-controlcatalog	rust	< 1.74.0	1.74.0
aws-sdk-controltower	rust	< 1.95.0	1.95.0
aws-sdk-costandusagereport	rust	< 1.90.0	1.90.0
aws-sdk-costexplorer	rust	< 1.101.0	1.101.0
aws-sdk-costoptimizationhub	rust	< 1.94.0	1.94.0
aws-sdk-customerprofiles	rust	< 1.98.0	1.98.0
aws-sdk-databasemigration	rust	< 1.98.0	1.98.0
aws-sdk-databrew	rust	< 1.89.0	1.89.0
aws-sdk-dataexchange	rust	< 1.92.0	1.92.0
aws-sdk-datapipeline	rust	< 1.89.0	1.89.0
aws-sdk-datasync	rust	< 1.97.0	1.97.0
aws-sdk-datazone	rust	< 1.112.0	1.112.0
aws-sdk-dax	rust	< 1.90.0	1.90.0
aws-sdk-deadline	rust	< 1.83.0	1.83.0
aws-sdk-detective	rust	< 1.90.0	1.90.0
aws-sdk-devicefarm	rust	< 1.92.0	1.92.0
aws-sdk-devopsguru	rust	< 1.89.0	1.89.0
aws-sdk-directconnect	rust	< 1.93.0	1.93.0
aws-sdk-directory	rust	< 1.94.0	1.94.0
aws-sdk-directoryservicedata	rust	< 1.46.0	1.46.0
aws-sdk-dlm	rust	< 1.89.0	1.89.0
aws-sdk-docdb	rust	< 1.96.0	1.96.0
aws-sdk-docdbelastic	rust	< 1.91.0	1.91.0
aws-sdk-drs	rust	< 1.92.0	1.92.0
aws-sdk-dsql	rust	< 1.44.0	1.44.0
aws-sdk-dynamodb	rust	< 1.98.0	1.98.0
aws-sdk-dynamodbstreams	rust	< 1.90.0	1.90.0
aws-sdk-ebs	rust	< 1.89.0	1.89.0
aws-sdk-ec2	rust	< 1.181.0	1.181.0
aws-sdk-ec2instanceconnect	rust	< 1.89.0	1.89.0
aws-sdk-ecr	rust	< 1.98.0	1.98.0
aws-sdk-ecrpublic	rust	< 1.92.0	1.92.0
aws-sdk-ecs	rust	< 1.104.0	1.104.0
aws-sdk-efs	rust	< 1.92.0	1.92.0
aws-sdk-eks	rust	< 1.113.0	1.113.0
aws-sdk-eksauth	rust	< 1.86.0	1.86.0
aws-sdk-elasticache	rust	< 1.95.0	1.95.0
aws-sdk-elasticbeanstalk	rust	< 1.90.0	1.90.0
aws-sdk-elasticloadbalancing	rust	< 1.90.0	1.90.0
aws-sdk-elasticloadbalancingv2	rust	< 1.99.0	1.99.0
aws-sdk-elasticsearch	rust	< 1.92.0	1.92.0
aws-sdk-elastictranscoder	rust	< 1.90.0	1.90.0
aws-sdk-emr	rust	< 1.96.0	1.96.0
aws-sdk-emrcontainers	rust	< 1.95.0	1.95.0
aws-sdk-emrserverless	rust	< 1.97.0	1.97.0
aws-sdk-entityresolution	rust	< 1.98.0	1.98.0
aws-sdk-eventbridge	rust	< 1.96.0	1.96.0
aws-sdk-evidently	rust	< 1.89.0	1.89.0
aws-sdk-evs	rust	< 1.19.0	1.19.0
aws-sdk-finspace	rust	< 1.93.0	1.93.0
aws-sdk-finspacedata	rust	< 1.89.0	1.89.0
aws-sdk-firehose	rust	< 1.97.0	1.97.0
aws-sdk-fis	rust	< 1.92.0	1.92.0
aws-sdk-fms	rust	< 1.93.0	1.93.0
aws-sdk-forecast	rust	< 1.89.0	1.89.0
aws-sdk-forecastquery	rust	< 1.89.0	1.89.0
aws-sdk-frauddetector	rust	< 1.89.0	1.89.0
aws-sdk-freetier	rust	< 1.87.0	1.87.0
aws-sdk-fsx	rust	< 1.100.0	1.100.0
aws-sdk-gamelift	rust	< 1.96.0	1.96.0
aws-sdk-gameliftstreams	rust	< 1.31.0	1.31.0
aws-sdk-geomaps	rust	< 1.44.0	1.44.0
aws-sdk-geoplaces	rust	< 1.43.0	1.43.0
aws-sdk-georoutes	rust	< 1.43.0	1.43.0
aws-sdk-glacier	rust	< 1.89.0	1.89.0
aws-sdk-globalaccelerator	rust	< 1.91.0	1.91.0
aws-sdk-glue	rust	< 1.128.0	1.128.0
aws-sdk-grafana	rust	< 1.91.0	1.91.0
aws-sdk-greengrass	rust	< 1.89.0	1.89.0
aws-sdk-greengrassv2	rust	< 1.90.0	1.90.0
aws-sdk-groundstation	rust	< 1.92.0	1.92.0
aws-sdk-guardduty	rust	< 1.103.0	1.103.0
aws-sdk-health	rust	< 1.89.0	1.89.0
aws-sdk-healthlake	rust	< 1.92.0	1.92.0
aws-sdk-iam	rust	< 1.95.0	1.95.0
aws-sdk-identitystore	rust	< 1.89.0	1.89.0
aws-sdk-imagebuilder	rust	< 1.96.0	1.96.0
aws-sdk-inspector	rust	< 1.89.0	1.89.0
aws-sdk-inspector2	rust	< 1.99.0	1.99.0
aws-sdk-inspectorscan	rust	< 1.89.0	1.89.0
aws-sdk-internetmonitor	rust	< 1.94.0	1.94.0
aws-sdk-invoicing	rust	< 1.40.0	1.40.0
aws-sdk-iot	rust	< 1.100.0	1.100.0
aws-sdk-iotanalytics	rust	< 1.89.0	1.89.0
aws-sdk-iotdataplane	rust	< 1.90.0	1.90.0
aws-sdk-iotdeviceadvisor	rust	< 1.90.0	1.90.0
aws-sdk-iotevents	rust	< 1.90.0	1.90.0
aws-sdk-ioteventsdata	rust	< 1.89.0	1.89.0
aws-sdk-iotfleetwise	rust	< 1.96.0	1.96.0
aws-sdk-iotjobsdataplane	rust	< 1.90.0	1.90.0
aws-sdk-iotmanagedintegrations	rust	< 1.31.0	1.31.0
aws-sdk-iotsecuretunneling	rust	< 1.90.0	1.90.0
aws-sdk-iotsitewise	rust	< 1.96.0	1.96.0
aws-sdk-iotthingsgraph	rust	< 1.89.0	1.89.0
aws-sdk-iottwinmaker	rust	< 1.89.0	1.89.0
aws-sdk-iotwireless	rust	< 1.95.0	1.95.0
aws-sdk-ivs	rust	< 1.95.0	1.95.0
aws-sdk-ivschat	rust	< 1.90.0	1.90.0
aws-sdk-ivsrealtime	rust	< 1.100.0	1.100.0
aws-sdk-kafka	rust	< 1.93.0	1.93.0
aws-sdk-kafkaconnect	rust	< 1.91.0	1.91.0
aws-sdk-kendra	rust	< 1.91.0	1.91.0
aws-sdk-kendraranking	rust	< 1.88.0	1.88.0
aws-sdk-keyspaces	rust	< 1.94.0	1.94.0
aws-sdk-keyspacesstreams	rust	< 1.16.0	1.16.0
aws-sdk-kinesis	rust	< 1.95.0	1.95.0
aws-sdk-kinesisanalytics	rust	< 1.89.0	1.89.0
aws-sdk-kinesisanalyticsv2	rust	< 1.93.0	1.93.0
aws-sdk-kinesisvideo	rust	< 1.90.0	1.90.0
aws-sdk-kinesisvideoarchivedmedia	rust	< 1.90.0	1.90.0
aws-sdk-kinesisvideomedia	rust	< 1.89.0	1.89.0
aws-sdk-kinesisvideosignaling	rust	< 1.89.0	1.89.0
aws-sdk-kinesisvideowebrtcstorage	rust	< 1.90.0	1.90.0
aws-sdk-kms	rust	< 1.93.0	1.93.0
aws-sdk-lakeformation	rust	< 1.93.0	1.93.0
aws-sdk-lambda	rust	< 1.104.0	1.104.0
aws-sdk-launchwizard	rust	< 1.90.0	1.90.0
aws-sdk-lexmodelbuilding	rust	< 1.89.0	1.89.0
aws-sdk-lexmodelsv2	rust	< 1.95.0	1.95.0
aws-sdk-lexruntime	rust	< 1.89.0	1.89.0
aws-sdk-lexruntimev2	rust	< 1.89.0	1.89.0
aws-sdk-licensemanager	rust	< 1.91.0	1.91.0
aws-sdk-licensemanagerlinuxsubscriptions	rust	< 1.90.0	1.90.0
aws-sdk-licensemanagerusersubscriptions	rust	< 1.92.0	1.92.0
aws-sdk-lightsail	rust	< 1.95.0	1.95.0
aws-sdk-location	rust	< 1.94.0	1.94.0
aws-sdk-lookoutequipment	rust	< 1.91.0	1.91.0
aws-sdk-m2	rust	< 1.93.0	1.93.0
aws-sdk-machinelearning	rust	< 1.89.0	1.89.0
aws-sdk-macie2	rust	< 1.92.0	1.92.0
aws-sdk-mailmanager	rust	< 1.72.0	1.72.0
aws-sdk-managedblockchain	rust	< 1.89.0	1.89.0
aws-sdk-managedblockchainquery	rust	< 1.92.0	1.92.0
aws-sdk-marketplaceagreement	rust	< 1.86.0	1.86.0
aws-sdk-marketplacecatalog	rust	< 1.94.0	1.94.0
aws-sdk-marketplacecommerceanalytics	rust	< 1.89.0	1.89.0
aws-sdk-marketplacedeployment	rust	< 1.86.0	1.86.0
aws-sdk-marketplaceentitlement	rust	< 1.93.0	1.93.0
aws-sdk-marketplacemetering	rust	< 1.91.0	1.91.0
aws-sdk-marketplacereporting	rust	< 1.45.0	1.45.0
aws-sdk-mediaconnect	rust	< 1.95.0	1.95.0
aws-sdk-mediaconvert	rust	< 1.110.0	1.110.0
aws-sdk-medialive	rust	< 1.114.0	1.114.0
aws-sdk-mediapackage	rust	< 1.89.0	1.89.0
aws-sdk-mediapackagev2	rust	< 1.99.0	1.99.0
aws-sdk-mediapackagevod	rust	< 1.89.0	1.89.0
aws-sdk-mediastore	rust	< 1.89.0	1.89.0
aws-sdk-mediastoredata	rust	< 1.89.0	1.89.0
aws-sdk-mediatailor	rust	< 1.97.0	1.97.0
aws-sdk-medicalimaging	rust	< 1.94.0	1.94.0
aws-sdk-memorydb	rust	< 1.93.0	1.93.0
aws-sdk-mgn	rust	< 1.89.0	1.89.0
aws-sdk-migrationhub	rust	< 1.90.0	1.90.0
aws-sdk-migrationhubconfig	rust	< 1.89.0	1.89.0
aws-sdk-migrationhuborchestrator	rust	< 1.90.0	1.90.0
aws-sdk-migrationhubrefactorspaces	rust	< 1.89.0	1.89.0
aws-sdk-migrationhubstrategy	rust	< 1.89.0	1.89.0
aws-sdk-mpa	rust	< 1.16.0	1.16.0
aws-sdk-mq	rust	< 1.92.0	1.92.0
aws-sdk-mturk	rust	< 1.89.0	1.89.0
aws-sdk-mwaa	rust	< 1.95.0	1.95.0
aws-sdk-neptune	rust	< 1.92.0	1.92.0
aws-sdk-neptunedata	rust	< 1.90.0	1.90.0
aws-sdk-neptunegraph	rust	< 1.89.0	1.89.0
aws-sdk-networkfirewall	rust	< 1.98.0	1.98.0
aws-sdk-networkflowmonitor	rust	< 1.43.0	1.43.0
aws-sdk-networkmanager	rust	< 1.93.0	1.93.0
aws-sdk-networkmonitor	rust	< 1.80.0	1.80.0
aws-sdk-notifications	rust	< 1.42.0	1.42.0
aws-sdk-notificationscontacts	rust	< 1.40.0	1.40.0
aws-sdk-oam	rust	< 1.92.0	1.92.0
aws-sdk-observabilityadmin	rust	< 1.42.0	1.42.0
aws-sdk-odb	rust	< 1.15.0	1.15.0
aws-sdk-omics	rust	< 1.96.0	1.96.0
aws-sdk-opensearch	rust	< 1.103.0	1.103.0
aws-sdk-opensearchserverless	rust	< 1.96.0	1.96.0
aws-sdk-organizations	rust	< 1.100.0	1.100.0
aws-sdk-osis	rust	< 1.93.0	1.93.0
aws-sdk-outposts	rust	< 1.99.0	1.99.0
aws-sdk-panorama	rust	< 1.89.0	1.89.0
aws-sdk-partnercentralselling	rust	< 1.43.0	1.43.0
aws-sdk-paymentcryptography	rust	< 1.96.0	1.96.0
aws-sdk-paymentcryptographydata	rust	< 1.95.0	1.95.0
aws-sdk-pcaconnectorad	rust	< 1.90.0	1.90.0
aws-sdk-pcaconnectorscep	rust	< 1.59.0	1.59.0
aws-sdk-pcs	rust	< 1.58.0	1.58.0
aws-sdk-personalize	rust	< 1.92.0	1.92.0
aws-sdk-personalizeevents	rust	< 1.89.0	1.89.0
aws-sdk-personalizeruntime	rust	< 1.89.0	1.89.0
aws-sdk-pi	rust	< 1.91.0	1.91.0
aws-sdk-pinpoint	rust	< 1.91.0	1.91.0
aws-sdk-pinpointemail	rust	< 1.89.0	1.89.0
aws-sdk-pinpointsmsvoice	rust	< 1.89.0	1.89.0
aws-sdk-pinpointsmsvoicev2	rust	< 1.97.0	1.97.0
aws-sdk-pipes	rust	< 1.92.0	1.92.0
aws-sdk-polly	rust	< 1.94.0	1.94.0
aws-sdk-pricing	rust	< 1.92.0	1.92.0
aws-sdk-proton	rust	< 1.88.0	1.88.0
aws-sdk-qapps	rust	< 1.57.0	1.57.0
aws-sdk-qbusiness	rust	< 1.104.0	1.104.0
aws-sdk-qconnect	rust	< 1.98.0	1.98.0
aws-sdk-quicksight	rust	< 1.111.0	1.111.0
aws-sdk-ram	rust	< 1.89.0	1.89.0
aws-sdk-rbin	rust	< 1.91.0	1.91.0
aws-sdk-rds	rust	< 1.114.0	1.114.0
aws-sdk-rdsdata	rust	< 1.91.0	1.91.0
aws-sdk-redshift	rust	< 1.94.0	1.94.0
aws-sdk-redshiftdata	rust	< 1.92.0	1.92.0
aws-sdk-redshiftserverless	rust	< 1.94.0	1.94.0
aws-sdk-rekognition	rust	< 1.93.0	1.93.0
aws-sdk-repostspace	rust	< 1.88.0	1.88.0
aws-sdk-resiliencehub	rust	< 1.93.0	1.93.0
aws-sdk-resourceexplorer2	rust	< 1.92.0	1.92.0
aws-sdk-resourcegroups	rust	< 1.92.0	1.92.0
aws-sdk-resourcegroupstagging	rust	< 1.88.0	1.88.0
aws-sdk-rolesanywhere	rust	< 1.93.0	1.93.0
aws-sdk-route53	rust	< 1.100.0	1.100.0
aws-sdk-route53domains	rust	< 1.93.0	1.93.0
aws-sdk-route53profiles	rust	< 1.68.0	1.68.0
aws-sdk-route53recoverycluster	rust	< 1.89.0	1.89.0
aws-sdk-route53recoverycontrolconfig	rust	< 1.90.0	1.90.0
aws-sdk-route53recoveryreadiness	rust	< 1.89.0	1.89.0
aws-sdk-route53resolver	rust	< 1.95.0	1.95.0
aws-sdk-rtbfabric	rust	< 1.3.0	1.3.0
aws-sdk-rum	rust	< 1.91.0	1.91.0
aws-sdk-s3	rust	< 1.112.0	1.112.0
aws-sdk-s3control	rust	< 1.103.0	1.103.0
aws-sdk-s3outposts	rust	< 1.89.0	1.89.0
aws-sdk-s3tables	rust	< 1.43.0	1.43.0
aws-sdk-s3vectors	rust	< 1.14.0	1.14.0
aws-sdk-sagemaker	rust	< 1.166.0	1.166.0
aws-sdk-sagemakera2iruntime	rust	< 1.89.0	1.89.0
aws-sdk-sagemakeredge	rust	< 1.89.0	1.89.0
aws-sdk-sagemakerfeaturestoreruntime	rust	< 1.90.0	1.90.0
aws-sdk-sagemakergeospatial	rust	< 1.89.0	1.89.0
aws-sdk-sagemakermetrics	rust	< 1.91.0	1.91.0
aws-sdk-sagemakerruntime	rust	< 1.91.0	1.91.0
aws-sdk-savingsplans	rust	< 1.90.0	1.90.0
aws-sdk-scheduler	rust	< 1.89.0	1.89.0
aws-sdk-schemas	rust	< 1.89.0	1.89.0
aws-sdk-secretsmanager	rust	< 1.93.0	1.93.0
aws-sdk-securityhub	rust	< 1.97.0	1.97.0
aws-sdk-securityir	rust	< 1.42.0	1.42.0
aws-sdk-securitylake	rust	< 1.92.0	1.92.0
aws-sdk-serverlessapplicationrepository	rust	< 1.89.0	1.89.0
aws-sdk-servicecatalog	rust	< 1.91.0	1.91.0
aws-sdk-servicecatalogappregistry	rust	< 1.89.0	1.89.0
aws-sdk-servicediscovery	rust	< 1.89.0	1.89.0
aws-sdk-servicequotas	rust	< 1.90.0	1.90.0
aws-sdk-ses	rust	< 1.92.0	1.92.0
aws-sdk-sesv2	rust	< 1.103.0	1.103.0
aws-sdk-sfn	rust	< 1.93.0	1.93.0
aws-sdk-shield	rust	< 1.89.0	1.89.0
aws-sdk-signer	rust	< 1.89.0	1.89.0
aws-sdk-simspaceweaver	rust	< 1.89.0	1.89.0
aws-sdk-snowball	rust	< 1.88.0	1.88.0
aws-sdk-snowdevicemanagement	rust	< 1.89.0	1.89.0
aws-sdk-sns	rust	< 1.90.0	1.90.0
aws-sdk-socialmessaging	rust	< 1.44.0	1.44.0
aws-sdk-sqs	rust	< 1.89.0	1.89.0
aws-sdk-ssm	rust	< 1.99.0	1.99.0
aws-sdk-ssmcontacts	rust	< 1.88.0	1.88.0
aws-sdk-ssmguiconnect	rust	< 1.24.0	1.24.0
aws-sdk-ssmincidents	rust	< 1.89.0	1.89.0
aws-sdk-ssmquicksetup	rust	< 1.53.0	1.53.0
aws-sdk-ssmsap	rust	< 1.93.0	1.93.0
aws-sdk-sso	rust	< 1.89.0	1.89.0
aws-sdk-ssoadmin	rust	< 1.91.0	1.91.0
aws-sdk-ssooidc	rust	< 1.91.0	1.91.0
aws-sdk-storagegateway	rust	< 1.96.0	1.96.0
aws-sdk-sts	rust	< 1.91.0	1.91.0
aws-sdk-supplychain	rust	< 1.84.0	1.84.0
aws-sdk-support	rust	< 1.89.0	1.89.0
aws-sdk-supportapp	rust	< 1.89.0	1.89.0
aws-sdk-swf	rust	< 1.91.0	1.91.0
aws-sdk-synthetics	rust	< 1.97.0	1.97.0
aws-sdk-taxsettings	rust	< 1.67.0	1.67.0
aws-sdk-textract	rust	< 1.89.0	1.89.0
aws-sdk-timestreaminfluxdb	rust	< 1.78.0	1.78.0
aws-sdk-timestreamquery	rust	< 1.93.0	1.93.0
aws-sdk-timestreamwrite	rust	< 1.90.0	1.90.0
aws-sdk-tnb	rust	< 1.90.0	1.90.0
aws-sdk-transcribe	rust	< 1.94.0	1.94.0
aws-sdk-transcribestreaming	rust	< 1.92.0	1.92.0
aws-sdk-transfer	rust	< 1.102.0	1.102.0
aws-sdk-translate	rust	< 1.89.0	1.89.0
aws-sdk-trustedadvisor	rust	< 1.90.0	1.90.0
aws-sdk-verifiedpermissions	rust	< 1.99.0	1.99.0
aws-sdk-voiceid	rust	< 1.89.0	1.89.0
aws-sdk-vpclattice	rust	< 1.92.0	1.92.0
aws-sdk-waf	rust	< 1.89.0	1.89.0
aws-sdk-wafregional	rust	< 1.90.0	1.90.0
aws-sdk-wafv2	rust	< 1.101.0	1.101.0
aws-sdk-wellarchitected	rust	< 1.90.0	1.90.0
aws-sdk-wisdom	rust	< 1.90.0	1.90.0
aws-sdk-workdocs	rust	< 1.89.0	1.89.0
aws-sdk-workmail	rust	< 1.91.0	1.91.0
aws-sdk-workmailmessageflow	rust	< 1.89.0	1.89.0
aws-sdk-workspaces	rust	< 1.105.0	1.105.0
aws-sdk-workspacesinstances	rust	< 1.16.0	1.16.0
aws-sdk-workspacesthinclient	rust	< 1.95.0	1.95.0
aws-sdk-workspacesweb	rust	< 1.95.0	1.95.0
aws-sdk-xray	rust	< 1.90.0	1.90.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the lack of input validation for the region parameter when constructing AWS service endpoints. The patch for this vulnerability is not in the aws-sdk-rust repository directly, but in its code generator, smithy-rs. The pull request smithy-lang/smithy-rs/pull/4383 contains the fix. The commit 0dc72856b9ed7317987a14e992b5db4955ca235e introduces validation logic. Specifically, it modifies the code generator to inject a validation step into the build() method of the generated config::endpoint::ParamsBuilder struct for each AWS service. This validation checks if the provided region is a valid host label. The vulnerable function is therefore config::endpoint::ParamsBuilder::build in all affected AWS SDK for Rust crates, as it is the function that, prior to the patch, would process the malicious input without validation. The exploit occurs when this function is called during the endpoint resolution process, which typically happens when an API call is made (e.g., via client.some_operation().send().await).

Vulnerable functions

config::endpoint::ParamsBuilder::build

codegen-client/src/main/kotlin/software/amazon/smithy/rust/codegen/client/smithy/endpoint/generators/EndpointParamsGenerator.kt

The `build` function in the generated `ParamsBuilder` is responsible for constructing the parameters used for endpoint resolution. Prior to the patch, this function did not validate the `region` parameter. An attacker with control over the environment could provide a malicious region string, causing the SDK to construct an endpoint URL pointing to a non-AWS host. The patch, implemented in `RegionDecorator.kt` and applied by `EndpointParamsGenerator.kt`, adds validation to ensure the region is a valid host label, mitigating this risk.

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

3.7

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-g59m-gf8j-gjf5: AWS SDK for Rust v1 adopted defense in depth enhancement for region parameter value

Summary

Impact

Patches

Workarounds

References

Acknowledgement

GHSA-g59m-gf8j-gjf5:

3.7

-

Basic Information

Basic Information

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

3.7

3.7

GHSA-g59m-gf8j-gjf5: AWS SDK for Rust v1 adopted defense in depth enhancement for region parameter value

Summary

Impact

Patches

Workarounds

References

Acknowledgement

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

Basic Information

Basic Information

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI