CVE-2026-104020 Overview
CVE-2026-104020 is an uncontrolled recursion vulnerability [CWE-674] in the Ion reader component of Amazon Ion Python versions prior to 0.15.0. A remote unauthenticated attacker can submit a crafted Ion value containing deeply nested structures to trigger excessive recursion in the parser. The condition exhausts the Python interpreter stack and crashes the host application, producing a denial-of-service outcome. Amazon addressed the issue in Ion Python 0.15.0, and users must upgrade to that release or later. The flaw affects any service or application that parses untrusted Ion data using the vulnerable library.
Critical Impact
Remote unauthenticated attackers can crash applications that deserialize Ion data by submitting a single deeply nested payload, interrupting availability of dependent services.
Affected Products
- Amazon Ion Python versions before 0.15.0
- Applications and services that embed the vulnerable ion-python library for parsing Ion data
- AWS workloads referenced in AWS Security Bulletin 2026-122
Discovery Timeline
- 2026-10-01 - CVE-2026-104020 published to the National Vulnerability Database
- 2026-10-02 - Last updated in NVD database
Technical Details for CVE-2026-104020
Vulnerability Analysis
The Ion reader in ion-python recursively descends into container values such as lists, s-expressions, and structs while decoding Ion text or binary input. The parser does not enforce a maximum nesting depth, so each additional container level consumes another Python call frame. An attacker who supplies a crafted payload with sufficient nesting drives the interpreter past its recursion limit and raises an unhandled error that terminates the process. Because Ion is commonly used for data interchange across AWS and third-party pipelines, the crash propagates to any service that accepts externally supplied Ion content. The outcome is loss of availability for the affected application, not disclosure or modification of data.
Root Cause
The root cause is the absence of a bounded recursion guard in the Ion reader when traversing nested container values. The parser treats arbitrarily deep structures as valid input and relies on the Python runtime stack as the only limit. This pattern matches [CWE-674: Uncontrolled Recursion], where attacker-controlled input directly governs call-stack depth.
Attack Vector
The attack is network-reachable and requires no authentication or user interaction. An attacker sends a crafted Ion document containing deeply nested containers to any endpoint that parses Ion input with a vulnerable version of ion-python. Parsing the payload exhausts the stack and crashes the worker or process. Repeated submissions sustain the denial-of-service condition.
No verified proof-of-concept code is published. The exploitation pattern is a payload consisting of repeated opening container tokens, such as nested lists or structs, deep enough to exceed the interpreter recursion limit. Technical specifics are available in GitHub Security Advisory GHSA-93q6-f8hx-vv7f.
Detection Methods for CVE-2026-104020
Indicators of Compromise
- Unhandled RecursionError exceptions originating from ion-python modules in application logs
- Repeated process crashes or worker restarts tied to Ion payload parsing
- Inbound requests containing Ion payloads with unusually large or deeply nested container structures
Detection Strategies
- Inventory Python dependencies and flag any ion-python or amazon.ion package below version 0.15.0
- Inspect application logs and crash dumps for RecursionError or stack-exhaustion traces inside Ion reader call frames
- Monitor ingress traffic for Ion payloads whose structural depth exceeds reasonable business thresholds
Monitoring Recommendations
- Alert on sudden spikes in process restarts, worker respawns, or 5xx responses from services that accept Ion input
- Correlate crash events with source IPs submitting Ion content to identify abusive clients
- Track upstream advisories from the AWS Security Bulletin 2026-122 for related guidance
How to Mitigate CVE-2026-104020
Immediate Actions Required
- Upgrade ion-python to version 0.15.0 or later across all applications and container images
- Audit services that accept Ion data from untrusted sources and prioritize them for patching
- Add rate limiting and request-size caps on endpoints that deserialize Ion input until patching completes
Patch Information
Amazon released the fix in ion-python v0.15.0. Upgrade using pip install --upgrade amazon.ion and rebuild any downstream packages or container images that pin earlier versions. Refer to GitHub Security Advisory GHSA-93q6-f8hx-vv7f for the authoritative advisory.
Workarounds
- Reject Ion payloads above a conservative byte-size threshold at the network or application boundary
- Validate structural depth of incoming Ion documents before passing them to the reader
- Isolate Ion parsing in short-lived worker processes so a crash does not take down the parent service
# Configuration example
pip install --upgrade "amazon.ion>=0.15.0"
pip show amazon.ion | grep -i version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
