AWSAWS-2026-122
Uncontrolled recursion in the Ion reader in Amazon Ion Python
High7.5CVE-2026-104020 · Published Oct 1, 2026
Bulletin ID: 2026-122-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/01/2026 13:30 PM PDT Description: Amazon Ion Python is an open-source Python implementation of the Amazon Ion data notation. We identified CVE-2026-104020, an issue in the Ion reader in Amazon Ion Python before version 0.15.0 where a crafted, deeply nested Ion value could cause the application to raise an error or crash, resulting in a denial of service. Impacted versions: < 0.15.0 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
Affected versions
The source does not list versions here. See the source advisory for affected products and fixes.
Changes since it was listed
| Date | Change |
|---|---|
| Oct 2 | Severity: Unrated to High |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Severity from
- NVD
More AWS advisories
All AWS| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Oct 1 | Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python) Medium5.3Oct 1 | Medium5.3 | No fix yet |
| Oct 1 | Argument injection in AWS security-agent-mcp-server diff scanHigh8.2Oct 1 | High8.2 | No fix yet |
| Oct 1 | Mount Option Injection in Amazon EFS CSI DriverMedium6.5Oct 1 | Medium6.5 | No fix yet |
| Sep 29 | GluonTS arbitrary command execution during model deserializationHigh7.8Sep 29 | High7.8 | No fix yet |
| Sep 25 | REMOVE_BASE_PATH strips every leading repetition of the base path, not just oneLowSep 25 | Low | 1.1.0 |
| Sep 24 | Type confusion in AWS pgcollection allows remote code executionHigh8.8Sep 24 | High8.8 | No fix yet |