The Amazon Athena ODBC driver allocates memory and other resources during the parsing of input without imposing limits. When an adversary can influence or supply the data that the driver parses, they can craft input that forces the driver to consume excessive resources, ultimately exhausting its capacity and causing the application to crash or become unresponsive. This flaw exemplifies CWE-770, a resource‑exhaustion weakness.

Amazon’s Athena ODBC driver on Linux, macOS (both Intel and arm architectures), and Windows is affected. Every installation of the driver with a version older than 2.1.0.0 is vulnerable, regardless of the underlying operating system.

With a CVSS score of 8.7 the vulnerability is classified as high severity. The EPSS score is less than 1%, indicating a low likelihood of exploitation in the near term, and the issue is not present in the CISA Known Exploited Vulnerabilities catalog. Based on the description, the likely attack vector involves an attacker delivering crafted input that the driver will parse, triggering uncontrolled consumption of resources. No additional conditions are stated, so the vulnerability can be exploited when the driver processes malicious or malformed data.