Executive brief
Amazon Ion-C is a C library that applications use to read and write Ion data format files. An uncontrolled recursion flaw allows a remote attacker to send specially crafted Ion data that exhausts the application's call stack, causing it to crash and resulting in service unavailability for users and operations depending on that application.
Technical details
The vulnerability is an uncontrolled recursion flaw in the Ion reader component of Amazon Ion-C before version 1.1.6. The ion-c library is used by applications to parse Ion binary and text data formats. An unauthenticated remote attacker can craft malicious Ion data with deeply nested structures that trigger excessive recursive calls in the reader, ultimately exhausting the process's native call stack and causing an application crash (denial of service). No authentication or special privileges are required to exploit this vulnerability. The attack vector is network-based, requiring only the ability to send malicious Ion data to an affected application. A patch is available in version 1.1.6 and later.
Affected products
- Amazon Ion-C before 1.1.6
Timeline
- 2026-09-02: disclosed