CVE-2026-104020

Summary

The Amazon Ion Python library contains a flaw in its Ion reader that can lead to uncontrolled recursion when processing deeply nested Ion values, potentially causing application crashes and denial of service. This vulnerability affects applications using the library without requiring authentication or user interaction.

Exploitability

Exploitation is straightforward as it requires only sending a crafted, deeply nested Ion value to an application using the vulnerable library, with no authentication or user interaction needed.

Blast radius

The vulnerability could impact any application that processes Ion data from untrusted sources, potentially causing widespread denial of service across systems relying on this library for data parsing.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Amazon Ion Python version 0.15.0 or later to remediate the uncontrolled recursion issue.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.