Description
An uncontrolled recursion issue exists in Amazon Ion-C versions before 1.1.6 that might allow a remote unauthenticated actor to craft Ion data that exhausts the native call stack and crashes the application using the library, resulting in a denial of service.
Published: 2026-09-02
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An uncontrolled recursion flaw exists in Amazon Ion‑C’s Ion reader. A remote unauthenticated actor can send crafted Ion data that forces the library to recurse deeply, exhausting the native call stack and causing the application to crash. The resulting denial of service compromises the availability of any system that uses the library. The vulnerability is categorized as CWE‑674.

Affected Systems

Amazon Ion‑C prior to version 1.1.6 is affected. Any product or service that integrates the library without upgrading is at risk until the upgrade to 1.1.6 or newer is applied. No other vendors or products are listed.

Risk and Exploitability

The CVSS score of 8.7 indicates high severity, and while the EPSS score is not available, the absence of a KEV listing suggests no confirmed exploits yet. The attack requires only the ability to transmit Ion data to an application that uses the library; no authentication is needed. If such data is introduced by an external source, the exceptionally deep recursion can immediately crash the process, leading to a service outage. The vulnerability is therefore reasonably exploitable in typical environments where untrusted Ion data is accepted.

Generated by OpenCVE AI on September 3, 2026 at 09:10 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Amazon Ion‑C to version 1.1.6 or later on all affected systems.
  • Reconfigure or replace any components that parse Ion data from untrusted or external inputs to limit nested structures or apply depth checks before processing.
  • Deploy application monitoring or watchdog mechanisms to detect crashes caused by stack overflows and isolate or restart affected services within a container or sandbox to contain potential outages.

Generated by OpenCVE AI on September 3, 2026 at 09:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 03 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 02 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Description An uncontrolled recursion issue exists in Amazon Ion-C versions before 1.1.6 that might allow a remote unauthenticated actor to craft Ion data that exhausts the native call stack and crashes the application using the library, resulting in a denial of service.
Title Uncontrolled recursion in the Ion reader in Amazon Ion-C before 1.1.6
First Time appeared Amazon
Amazon ion-c
Weaknesses CWE-674
CPEs cpe:2.3:a:amazon:ion-c:*:*:*:*:*:*:*:*
Vendors & Products Amazon
Amazon ion-c
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Amazon Ion-c
cve-icon MITRE

Status: PUBLISHED

Assigner: AMZN

Published:

Updated: 2026-09-03T13:15:45.459Z

Reserved: 2026-09-02T13:01:03.758Z

Link: CVE-2026-84851

cve-icon Vulnrichment

Updated: 2026-09-03T13:15:42.742Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-03T05:16:46.640

Modified: 2026-09-03T16:44:01.873

Link: CVE-2026-84851

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-03T09:45:03Z

Weaknesses