CVE-2026-35562: Amazon Athena ODBC driver denial of service in parsing components

CVE-2026-35562 · Severity: high · CVSS 7.5 · Published 2026-04-03

The Amazon Athena ODBC driver, which allows applications to connect to and query data in Amazon Athena, contains a vulnerability that can lead to a denial of service. An attacker could provide specially crafted input that causes the driver to consume excessive system resources like memory or CPU during data parsing. This could cause the application using the driver to crash or become unresponsive, disrupting business operations and data analysis workflows.

Technologies: Amazon Athena Odbc, Apple macOS, Linux Kernel, Microsoft Windows. Vendors: Amazon, Apple, Linux, Microsoft.

Quick answers

Is CVE-2026-35562 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-35562 being exploited in the wild.
How severe is CVE-2026-35562?
High severity, with a CVSS score of 7.5, published 3 April 2026.
Which products and versions are affected?
Amazon Amazon Athena ODBC driver < 2.1.0.0.
Is there a fix for CVE-2026-35562?
A patch was published on 2026-03-20: Version 2.1.0.0 released with security improvements. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35562 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-35562?
Check whether you run Amazon Athena Odbc, Apple macOS, Linux Kernel or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Amazon Athena ODBC driver is vulnerable to a denial of service (DoS) due to the allocation of resources without limits (CWE-770) within its parsing components. The flaw is triggered when the driver processes crafted input patterns, unbounded server responses, or deeply nested XML payloads (specifically SAML tokens). An attacker can exploit this by delivering malicious input that triggers excessive CPU or memory consumption during parsing operations. The vulnerability affects the driver on Windows, Linux, and macOS. To mitigate this, the vendor has implemented recursion depth limits (100 levels) and size limits (1MB) for XML/SAML tokens, as well as response size limits for ADFS. Users should upgrade to version 2.1.0.0 or later.

Affected products

  • Amazon Amazon Athena ODBC driver < 2.1.0.0

Timeline

  • 2026-03-20: patched: Version 2.1.0.0 released with security improvements.
  • 2026-04-03: disclosed: Initial vulnerability advisory published.
  • 2026-04-03: advisory: NVD entry created.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.