Skip to main content

Amazon Ion-C CVE-2026-84851

| EUVDEUVD-2026-70281 HIGH
Uncontrolled Recursion (CWE-674)
2026-09-02 AMZN
Denial Of Service Amazon Ion C
8.7
CVSS 4.0 · Vendor: AMZN
Share

Severity by source

Vendor (AMZN) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Network-delivered crafted Ion data, no privileges or interaction required; sole impact is application crash (A:H), scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (AMZN).

CVSS VectorVendor: AMZN

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

7
POC Analysis Generated
Sep 08, 2026 - 15:24 vuln.today
Analysis Updated
Sep 03, 2026 - 05:28 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Sep 03, 2026 - 05:22 vuln.today
cvss_changed
CVSS changed
Sep 03, 2026 - 05:22 NVD
7.5 (HIGH) 8.7 (HIGH)
Source Code Evidence Fetched
Sep 02, 2026 - 21:06 vuln.today
Analysis Generated
Sep 02, 2026 - 21:06 vuln.today
CVE Published
Sep 02, 2026 - 20:19 cve.org
HIGH 7.5

DescriptionCVE.org

An uncontrolled recursion issue exists in Amazon Ion-C versions before 1.1.6 that might allow a remote unauthenticated actor to craft Ion data that exhausts the native call stack and crashes the application using the library, resulting in a denial of service.

AnalysisAI

Uncontrolled recursion in Amazon Ion-C before v1.1.6 allows a remote unauthenticated attacker to crash any application that parses untrusted Ion data using this library, causing a denial of service via native call stack exhaustion. The fix, released in v1.1.6 and titled 'Harden container depth,' confirms the root cause is missing or insufficient depth limiting on nested Ion container parsing. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The target application must use Amazon Ion-C version earlier than 1.1.6 to parse Ion-format data supplied by an external or untrusted source. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) accurately reflects the impact: any network-reachable parsing endpoint backed by ion-c is trivially crashable with a crafted payload - low complexity, no privileges, no interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade Amazon Ion-C to v1.1.6 or later, which introduces container depth hardening via PR #370 ('Harden container depth'). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify and inventory all applications using Amazon Ion-C and determine which process untrusted or external Ion data. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Amazon

View all
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2024-6387 HIGH POC
8.1 Jul 01

Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to

CVE-2024-28056 CRITICAL POC
9.8 Apr 15

Amazon AWS Amplify CLI before 12.10.1 incorrectly configures the role trust policy of IAM roles associated with Amplify

CVE-2022-25809 CRITICAL POC
9.8 Feb 24

Improper Neutralization of audio output from 3rd and 4th Generation Amazon Echo Dot devices allows arbitrary voice comma
CVE-2021-44833 CRITICAL POC
9.8 Dec 12

The CLI 1.0.0 for Amazon AWS OpenSearch has weak permissions for the configuration file. Rated critical severity (CVSS 9
CVE-2019-3984 CRITICAL POC
9.8 Dec 31

Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due

CVE-2019-3989 CRITICAL POC
9.8 Dec 11

Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due

CVE-2023-35165 HIGH POC
8.8 Jun 23

AWS Cloud Development Kit (AWS CDK) is an open-source software development framework to define cloud infrastructure in c
CVE-2022-31115 HIGH POC
8.8 Jun 30

opensearch-ruby is a community-driven, open source fork of elasticsearch-ruby. Rated high severity (CVSS 8.8), this vuln
CVE-2022-0070 HIGH POC
8.8 Apr 19

Incomplete fix for CVE-2021-3100. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. Public ex
CVE-2021-43638 HIGH POC
8.8 Dec 07

Amazon Amazon WorkSpaces agent is affected by Integer Overflow. Rated high severity (CVSS 8.8), this vulnerability is lo
CVE-2021-43637 HIGH POC
8.8 Dec 07

Amazon WorkSpaces agent is affected by Buffer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack

Same weakness CWE-674 – Uncontrolled Recursion

View all
CVE-2019-9545 HIGH POC
8.8
CVE-2019-9543 HIGH POC
8.8
CVE-2019-9144 HIGH POC
8.8
CVE-2019-9143 HIGH POC
8.8
CVE-2026-9769 HIGH POC
8.7
CVE-2026-40345 HIGH POC
8.2
CVE-2025-9624 HIGH POC
8.3
CVE-2019-9192 HIGH POC
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

CVE-2026-84851 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy