CVE-2026-84851
Received Received - Intake

Denial of Service in Amazon Ion-C Library

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: AMZN

Description
An uncontrolled recursion issue exists in Amazon Ion-C versions before 1.1.6 that might allow a remote unauthenticated actor to craft Ion data that exhausts the native call stack and crashes the application using the library, resulting in a denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-84851

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
amazon ion-c to 1.1.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-84851 is an uncontrolled recursion vulnerability in Amazon Ion-C versions before 1.1.6. It allows a remote unauthenticated attacker to craft malicious Ion data that triggers excessive recursion, exhausting the native call stack and causing the application to crash, resulting in a denial of service.

Detection Guidance

Detecting this vulnerability requires monitoring for crashes or stack overflow errors in applications using Amazon Ion-C versions before 1.1.6. Check application logs for IERR_STACK_OVERFLOW errors or unexpected terminations during Ion data parsing. Monitor network traffic for malformed Ion data requests that may trigger excessive recursion.

Impact Analysis

This vulnerability can cause application crashes due to stack exhaustion, leading to denial of service. It does not require authentication or user interaction and can disrupt application availability remotely.

Compliance Impact

This vulnerability primarily causes denial of service by crashing applications through stack exhaustion, which could impact availability of systems handling sensitive data. For GDPR, availability is a key principle under Article 5, so prolonged outages might raise compliance concerns. HIPAA requires availability of ePHI, so service disruptions could violate Security Rule requirements. However, the vulnerability itself does not directly lead to data breaches or unauthorized access.

Mitigation Strategies

Immediately upgrade to Amazon Ion-C version 1.1.6 or later, which includes a default recursion depth limit. If upgrading is not possible, avoid using affected APIs like ion_writer_write_one_value or ion_writer_write_all_values. Manually process Ion data with controlled recursion depth to prevent stack overflow.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84851. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart