CVE-2026-104020

Published: Ott 01, 2026 Last Modified: Ott 02, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 8,7
Source: ff89ba41-3aa1-4d27-914a-91399e9639e5
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
HIGH 7,5
Source: ff89ba41-3aa1-4d27-914a-91399e9639e5
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: none
Availability: high

Description

AI Translation Available

Uncontrolled recursion in the Ion reader in Amazon Ion Python before 0.15.0 might allow a remote unauthenticated actor to crash the application using the library, resulting in a denial of service, via a crafted, deeply nested Ion value.

To remediate this issue, users should upgrade to version 0.15.0 or later.

674

Uncontrolled Recursion

Draft
Abstraction: Class Structure: Simple
Common Consequences
Security Scopes Affected:
Availability Confidentiality
Potential Impacts:
Dos: Resource Consumption (Cpu) Dos: Resource Consumption (Memory) Read Application Data
Applicable Platforms
All platforms may be affected
View CWE Details
https://aws.amazon.com/security/security-bulletins/2026-122…
https://aws.amazon.com/security/security-bulletins/2026-122-aws/
https://github.com/amazon-ion/ion-python/releases/tag/v0.15…
https://github.com/amazon-ion/ion-python/releases/tag/v0.15.0
https://github.com/amazon-ion/ion-python/security/advisorie…
https://github.com/amazon-ion/ion-python/security/advisories/GHSA-93q6-f8hx-vv7f