CVE-2026-84851

Amazon Ion-C, the C implementation of Amazon's Ion data serialization format, contains an uncontrolled recursion flaw (CWE-674) in versions before 1.1.6. An unauthenticated remote attacker can submit crafted Ion data whose deeply nested structure drives recursive parsing until the native call stack is exhausted, crashing the application that uses the library. The impact is denial of service only; the CVSS 4.0 score of 8.7 (High) reflects high availability impact with no confidentiality or integrity impact. Any application, service, or language binding that embeds Ion-C and parses Ion documents from untrusted sources is affected. Exploitation has not been observed: there is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates only about a 0.3% chance of exploitation within 30 days.

What to do: Upgrade Ion-C to 1.1.6 or later, and rebuild statically linked binaries or update any language bindings that bundle the library, since a library-only upgrade may not reach deployed copies. Until patched, validate or cap the nesting depth of untrusted Ion input before parsing and consider running parsers with more generous stack limits as partial mitigation. Inventory deployments that use ion-c directly or through bindings, as the flaw is only reachable when parsing attacker-controlled Ion data.