Description (CNA)
Uncontrolled recursion in the Ion reader in Amazon Ion Python before 0.15.0 might allow a remote unauthenticated actor to crash the application using the library, resulting in a denial of service, via a crafted, deeply nested Ion value. To remediate this issue, users should upgrade to version 0.15.0 or later.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Amazon / ion-python | affected 0 before 0.15.0 |
CWE
CWE-674
References
- https://github.com/amazon-ion/ion-python/releases/tag/v0.15.0
- https://aws.amazon.com/security/security-bulletins/2026-122-aws/
- https://github.com/amazon-ion/ion-python/security/advisories/GHSA-93q6-f8hx-vv7f
ADP enrichment
No English description supplied.
No references supplied.