CVE-2026-35559: Amazon Athena ODBC driver out-of-bounds write in query processing

CVE-2026-35559 · Severity: medium · CVSS 6.5 · Published 2026-04-03

The Amazon Athena ODBC driver is a software component that allows applications to connect to and query data stored in Amazon Athena. A vulnerability in how the driver processes query data could allow an attacker to crash the driver, leading to a denial-of-service condition for applications relying on the connection. This could disrupt business operations and data analysis workflows that depend on automated database queries.

Technologies: Amazon Athena Odbc, Apple macOS, Linux Kernel, Microsoft Windows. Vendors: Amazon, Apple, Linux, Microsoft.

Quick answers

Is CVE-2026-35559 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-35559 being exploited in the wild.
How severe is CVE-2026-35559?
Medium severity, with a CVSS score of 6.5, published 3 April 2026.
Which products and versions are affected?
Amazon Athena ODBC driver < 2.1.0.0.
Is there a fix for CVE-2026-35559?
A patch was published on 2026-03-20: Version 2.1.0.0 released with security fixes. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35559 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-35559?
Check whether you run Amazon Athena Odbc, Apple macOS, Linux Kernel or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds write vulnerability (CWE-787) exists in the query processing components of the Amazon Athena ODBC driver prior to version 2.1.0.0. The flaw is triggered when the driver processes specially crafted data or table metadata during query operations. An attacker could exploit this by providing malicious input that causes the driver to write data outside of allocated memory buffers, resulting in a crash (Denial of Service). While the attack vector is network-based, it typically requires some form of user interaction or the processing of specific query results. The issue has been resolved in version 2.1.0.0 by improving input validation and memory handling during query processing.

Affected products

  • Amazon Athena ODBC driver < 2.1.0.0

Timeline

  • 2026-03-20: patched: Version 2.1.0.0 released with security fixes.
  • 2026-04-03: disclosed: Initial CVE publication.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.