Live › vulnerability › CVE-2026-104020
Go to dashboardAmazon Ion Python before 0.15.0 has uncontrolled recursion in its Ion reader: a crafted, deeply nested Ion value makes the application raise an error or crash. An attacker who can feed it data gets a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 20:05 UTC, 0h before NVD. All times on this page are UTC.
Teams whose Python services parse Amazon Ion data, especially data from outside sources, are exposed. The sources do not say which applications parse untrusted Ion input by default, so check whether any input path reaches the Ion reader. Services that do not use amazon-ion, or only read Ion from trusted sources, can skip it.
No product ranges from the sources yet.
pip show amazon-ion (or pip freeze | grep -i ion) and check whether the installed version is below 0.15.0.amazon-ion to find where it is pulled in, including transitive dependencies.amazon-ion package to 0.15.0 or later.simpleion.c_ext = False and explicitly handle RecursionError raised from the simpleion module.The fix above is the answer. These hold the line until you can deploy it, and are the only option on lines that get no fix.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-104020 - Uncontrolled recursion in the Ion reader in Amazon Ion Python
Bulletin ID: 2026-122-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/01/2026 13:30 PM PDT
Description:
Amazon Ion Python is an open-source Python implementation of the Amazon Ion data notation. We identified CVE-2026-104020, an issue in the Ion reader in Amazon Ion Python before version 0.15.0 where a crafted, deeply nested Ion value could cause the application to raise an error or crash, resulting in a denial of service.
Impacted versions: < 0.15.0
Resolution:
This issue has been addressed in Amazon Ion Python version 0.15.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds:
Disable ion-python's C extension (simpleion.c_ext = False) and explicitly handle RecursionError raised from within the simpleion module.
References:
Acknowledgement:
We would like to thank Weiqi Wang and Lucas C. Cordeiro, University of Manchester, for collaborating on this issue through the coordinated vulnerability disclosure process.
Please email [email protected] with any security questions or concerns..
This page as .md · .json · in your agent: get_signal("CVE-2026-104020")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.