Uncontrolled recursion in the Ion reader in Amazon Ion-C before 1.1.6

UnratedCVE-2026-84851 · Published Sep 2, 2026 · updated Sep 9, 2026

Bulletin ID: 2026-094-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/02/2026 13:30 AM PDT Description: Amazon Ion-C (ion-c) is the C implementation of the Amazon Ion data serialization format. It is distributed as an open-source library (amazon-ion/ion-c) that applications embed to read and write Ion text and binary data. We identified CVE-2026-84851, an uncontrolled recursion issue in versions before 1.1.6 that might allow a remote unauthenticated actor to craft Ion data that exhausts the native call stack and crashes the application using the library, resulting in a denial of service. Impacted versions: < 1.1.6 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.