CVE-2026-104020

Received Received - Intake

Denial of Service in Amazon Ion Python via Recursion

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: AMZN

Description

Uncontrolled recursion in the Ion reader in Amazon Ion Python before 0.15.0 might allow a remote unauthenticated actor to crash the application using the library, resulting in a denial of service, via a crafted, deeply nested Ion value. To remediate this issue, users should upgrade to version 0.15.0 or later.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-01

Last Modified

2026-10-01

Generated

2026-10-02

AI Q&A

2026-10-02

EPSS Evaluated

N/A

NVD

CVE-2026-104020

EUVD

EUVD-2026-91059

Affected Vendors & Products

Vendor	Product	Version / Range
amazon	ion_python	0.15.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-674	The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

Executive Summary

This vulnerability involves uncontrolled recursion in the Ion reader of Amazon Ion Python before version 0.15.0. A remote unauthenticated attacker could exploit this by sending a deeply nested Ion value, causing the application to crash due to a denial of service.

Detection Guidance

This vulnerability can be detected by checking the version of the Amazon Ion Python library in use. If the version is below 0.15.0, the system is vulnerable. Use commands like 'pip show amazon.ion' or 'pip list | grep amazon.ion' to check the installed version.

Impact Analysis

The vulnerability could allow an attacker to crash your application by sending a specially crafted deeply nested Ion value, leading to a denial of service. This could disrupt services relying on the Amazon Ion Python library.

Compliance Impact

This vulnerability causes a denial of service via application crashes, which could disrupt data processing or availability. For GDPR, this may impact availability of personal data processing systems, potentially violating Article 32 requirements for resilience. For HIPAA, it could affect the availability of electronic protected health information, violating the Security Rule's integrity and availability standards.

Mitigation Strategies

Upgrade the Amazon Ion Python library to version 0.15.0 or later immediately. Use commands like 'pip install --upgrade amazon.ion' to perform the upgrade. Ensure no applications are running during the upgrade to avoid disruptions.

Hi! I’m here to help you understand CVE-2026-104020. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70