Junglewise Threat Intelligence

CVE-2026-35562: Amazon Athena ODBC driver denial of service in parsing components

CVE-2026-35562 · Severity: high · CVSS 7.5 · Published 2026-04-03

Technologies: Amazon Athena Odbc, Apple macOS, Microsoft Windows, Linux Kernel. Vendors: Amazon, Apple, Microsoft, Linux.

Executive brief

The Amazon Athena ODBC driver, which allows applications to connect to and query data in Amazon Athena, contains a vulnerability that can lead to a denial of service. An attacker could provide specially crafted input that causes the driver to consume excessive system resources like memory or CPU during data parsing. This could cause the application using the driver to crash or become unresponsive, disrupting business operations and data analysis workflows.

Technical details

The Amazon Athena ODBC driver is vulnerable to a denial of service (DoS) due to the allocation of resources without limits (CWE-770) within its parsing components. The flaw is triggered when the driver processes crafted input patterns, unbounded server responses, or deeply nested XML payloads (specifically SAML tokens). An attacker can exploit this by delivering malicious input that triggers excessive CPU or memory consumption during parsing operations. The vulnerability affects the driver on Windows, Linux, and macOS. To mitigate this, the vendor has implemented recursion depth limits (100 levels) and size limits (1MB) for XML/SAML tokens, as well as response size limits for ADFS. Users should upgrade to version 2.1.0.0 or later.

Affected products

  • Amazon Amazon Athena ODBC driver < 2.1.0.0

Timeline

  • 2026-03-20: patched: Version 2.1.0.0 released with security improvements.
  • 2026-04-03: disclosed: Initial vulnerability advisory published.
  • 2026-04-03: advisory: NVD entry created.

References

Related threats