Live › vulnerability › GHSA-93q6-f8hx-vv7f
Go to dashboardAmazon Ion Python before 0.15.0 has an uncontrolled recursion flaw in its Ion reader. A crafted, deeply nested Ion value makes the application raise an error or crash.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 20:05 UTC. All times on this page are UTC.
Applications that use Amazon Ion Python before 0.15.0 to read Ion data, especially data from untrusted sources, are exposed. The crash is triggered by the content of the input value, so the risk depends on whether the application parses outside input. Teams not using Ion Python, or already on 0.15.0 or later, can skip it.
No product ranges from the sources yet.
pip show amazon-ion (or pip show ion-python) and compare it to 0.15.0.0.15.0 or later.simpleion.c_ext = False and handle RecursionError raised from the simpleion module.The fix above is the answer. These hold the line until you can deploy it, and are the only option on lines that get no fix.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-104020 - Uncontrolled recursion in the Ion reader in Amazon Ion Python
Bulletin ID: 2026-122-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/01/2026 13:30 PM PDT
Description:
Amazon Ion Python is an open-source Python implementation of the Amazon Ion data notation. We identified CVE-2026-104020, an issue in the Ion reader in Amazon Ion Python before version 0.15.0 where a crafted, deeply nested Ion value could cause the application to raise an error or crash, resulting in a denial of service.
Impacted versions: < 0.15.0
Resolution:
This issue has been addressed in Amazon Ion Python version 0.15.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds:
Disable ion-python's C extension (simpleion.c_ext = False) and explicitly handle RecursionError raised from within the simpleion module.
References:
Acknowledgement:
We would like to thank Weiqi Wang and Lucas C. Cordeiro, University of Manchester, for collaborating on this issue through the coordinated vulnerability disclosure process.
Please email [email protected] with any security questions or concerns..
This page as .md · .json · in your agent: get_signal("GHSA-93q6-f8hx-vv7f")