Description

An uncontrolled recursion issue exists in Amazon Ion-C versions before 1.1.6 that might allow a remote unauthenticated actor to craft Ion data that exhausts the native call stack and crashes the application using the library, resulting in a denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-03T05:16:46.640Z",
  "pubdate": "2026-09-03T05:16:46.640Z",
  "executiveSummary": "Amazon Ion-C versions prior to 1.1.6 are susceptible to an uncontrolled recursion vulnerability during the parsing of Ion data. This security flaw allows an unauthenticated, remote attacker to trigger a stack exhaustion condition by submitting specifically crafted malicious Ion payloads.\nThe vulnerability arises from the library's inability to safely handle deeply nested data structures, which causes the parser to consume the native call stack beyond its allocated limit. Exploitation of this vulnerability results in an immediate application crash, leading to a Denial of Service (DoS) state. Given that no authentication is required to interact with the parser, the attack surface is exposed to any network entity capable of sending Ion data to the affected service. The primary risk is the disruption of service availability, which can impact any application relying on Amazon Ion-C for data ingestion or processing. There are no known requirements for elevated privileges to execute this attack, making it a critical availability concern for infrastructure components utilizing outdated versions of the library.",
  "technicalDetails": "The root cause of this vulnerability is an uncontrolled recursion mechanism within the Amazon Ion-C parsing logic. When the library processes Ion data, it employs a recursive descent approach or similar structure to traverse nested objects or lists. If the input data contains a deeply nested hierarchy, the parser continuously invokes recursive functions without sufficient depth validation or stack overflow protection.\nThe exploitation flow begins when an attacker identifies an application endpoint that accepts and deserializes Amazon Ion data. The attacker crafts a malicious payload containing an excessively deep structure of nested Ion containers (e.g., nested Ion structs or lists). When the Amazon Ion-C library attempts to parse this structure, each nested element triggers a new frame on the native execution stack. Because the parser lacks an enforcement mechanism to cap the recursion depth, the stack pointer increments continuously until it exceeds the thread's stack memory segment. This triggers a stack overflow exception, resulting in an unhandled termination of the process.\nThe vulnerability is present in the core parsing component of Amazon Ion-C. Because the library is designed for data serialization and deserialization, it is frequently exposed to external, untrusted input. An attacker does not require authentication or specific system privileges; they only require the ability to transmit a malformed payload to the application. The network exposure is broad, as any exposed service using the library as an entry point for data ingestion is inherently vulnerable. Post-exploitation impact is limited to the crash of the application process. While this does not inherently lead to remote code execution (RCE) in a standard configuration, the disruption of service caused by the DoS is significant in high-availability environments. The lack of input sanitization regarding structure depth renders the library susceptible to this resource exhaustion pattern."
}