Amazon Ion Python CVE-2026-104020

Exploitation requires that the target application use Amazon Ion Python before 0.15.0 to parse Ion data that originates from an untrusted/attacker-controlled source - the crafted deeply nested Ion value must reach the Ion reader. The limiting factor is exposure: an application that only parses trusted, internally generated Ion is not realistically exploitable, so the practical attack surface is services that accept and deserialize client-supplied Ion input. No authentication, user interaction, or special non-default configuration is otherwise needed (PR:N/UI:N), and the fix in v0.15.0 caps container nesting past the recursion limit by raising an IonException instead of crashing.

This is a CWE-674 uncontrolled-recursion denial-of-service flaw with an availability-only impact. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) indicates a network-reachable, low-complexity, unauthenticated attack with no confidentiality or integrity impact - only availability (VA:H), consistent with a crash/DoS rather than code execution. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The 8.7 'high' CVSS 4.0 score is driven almost entirely by the unauthenticated network vector combined with high availability impact; however, real-world risk is tempered by the fact that the impact is limited to crashing the application (no data loss or RCE) and that exploitation requires the target application to parse attacker-controlled Ion data. Net assessment: a legitimately exploitable but single-dimension (availability) issue - prioritize patching for any service that deserializes untrusted Ion input, but it is not a critical RCE-class emergency. The absence of EPSS/KEV/POC signals suggests this is currently a theoretical-to-low real-world exploitation priority rather than an actively weaponized threat.

An attacker identifies a network-facing service that uses Amazon Ion Python (<0.15.0) to parse Ion-formatted input it receives from clients. The attacker submits a crafted Ion value with extreme nesting depth, triggering uncontrolled recursion in the Ion reader that exhausts the stack and crashes the process, denying service to legitimate users. No authentication or user interaction is required, but no public PoC was identified in the provided data.