Ion Python
Monthly
Denial of service in Amazon Ion Python before 0.15.0 allows remote, unauthenticated attackers to crash applications that parse attacker-supplied Ion data by submitting a deeply nested Ion value that exhausts the interpreter's recursion stack. The flaw is availability-only (CWE-674 uncontrolled recursion) and requires the target service to route untrusted Ion input into the Ion reader; applications that only parse trusted, internally generated Ion are not realistically exposed, and no authentication, user interaction, or non-default configuration is needed otherwise (PR:N/UI:N). No public exploit code was identified at time of analysis and there is no indication of confirmed active exploitation (not listed in CISA KEV); the vendor fix in 0.15.0 caps container nesting past the recursion limit and surfaces the condition as an IonException instead of an uncontrolled crash.
Denial of service in Amazon Ion Python before 0.15.0 allows remote, unauthenticated attackers to crash applications that parse attacker-supplied Ion data by submitting a deeply nested Ion value that exhausts the interpreter's recursion stack. The flaw is availability-only (CWE-674 uncontrolled recursion) and requires the target service to route untrusted Ion input into the Ion reader; applications that only parse trusted, internally generated Ion are not realistically exposed, and no authentication, user interaction, or non-default configuration is needed otherwise (PR:N/UI:N). No public exploit code was identified at time of analysis and there is no indication of confirmed active exploitation (not listed in CISA KEV); the vendor fix in 0.15.0 caps container nesting past the recursion limit and surfaces the condition as an IonException instead of an uncontrolled crash.