CVE-2026-84851 Uncontrolled recursion in the Ion reader in Amazon Ion-C before 1.1.6
Remote attackers can crash applications using Amazon Ion-C by sending crafted data that causes uncontrolled recursion and stack exhaustion.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-84851?
CVE-2026-84851 is a high-severity denial of service vulnerability in Amazon ion-c, published on 2 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An uncontrolled recursion issue exists in Amazon Ion-C versions before 1.1.6 that might allow a remote unauthenticated actor to craft Ion data that exhausts the native call stack and crashes the application using the library, resulting in a denial of service.
Weakness: CWE-674
Which versions are affected by CVE-2026-84851?
How do I fix CVE-2026-84851?
No fix has been published for CVE-2026-84851 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-84851 being exploited?
There is no known exploitation of CVE-2026-84851 in the wild and no public exploit code.
Sources
Also known as GHSA-9gfg-hgj4-gh44.