CVE-2026-35559: Amazon Athena ODBC Driver DoS Vulnerability

CVE-2026-35559 Overview

CVE-2026-35559 is an out-of-bounds write vulnerability affecting the query processing components in Amazon Athena ODBC driver versions prior to 2.1.0.0. This memory corruption flaw allows a threat actor to crash the driver by crafting malicious data that is processed during query operations, leading to a denial of service condition.

Critical Impact
Attackers can exploit this out-of-bounds write vulnerability to cause driver crashes through specially crafted query data, potentially disrupting business-critical analytics workloads and data pipeline operations.

Affected Products

Amazon Athena ODBC Driver versions before 2.1.0.0 (Windows)
Amazon Athena ODBC Driver versions before 2.1.0.0 (Linux)
Amazon Athena ODBC Driver versions before 2.1.0.0 (macOS Intel and ARM)

Discovery Timeline

2026-04-03 - CVE-2026-35559 published to NVD
2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-35559

Vulnerability Analysis

This vulnerability is classified as CWE-787 (Out-of-bounds Write), a memory corruption issue where the application writes data past the end or before the beginning of an allocated buffer. In the context of the Amazon Athena ODBC driver, the vulnerability exists within the query processing components that handle data during query operations.

The out-of-bounds write condition occurs when the driver processes specially crafted input data. When an attacker supplies malicious data designed to trigger the boundary violation, the driver writes beyond the allocated memory region, corrupting adjacent memory structures. This memory corruption results in driver instability and ultimately causes a crash.

The attack requires network access and some user interaction to be exploited, as the malicious data must be processed through a query operation. While the vulnerability does not directly lead to code execution or data exfiltration, the availability impact is significant—a successful exploit can render the ODBC driver inoperable, disrupting applications that rely on Amazon Athena connectivity for analytics and data processing.

Root Cause

The root cause of CVE-2026-35559 is improper bounds checking within the query processing components of the Amazon Athena ODBC driver. When processing query data, the driver fails to properly validate the size or boundaries of input data before writing to memory buffers. This lack of adequate input validation allows data that exceeds expected bounds to overwrite memory outside the allocated buffer, triggering the out-of-bounds write condition.

Attack Vector

The attack vector for this vulnerability is network-based. An attacker can exploit this flaw by introducing specially crafted data into a query operation processed by the vulnerable ODBC driver. The exploitation scenario involves:

The victim application connects to Amazon Athena using the vulnerable ODBC driver
An attacker manipulates query data (either through a compromised data source or man-in-the-middle position)
The malicious data is processed by the driver's query processing components
The out-of-bounds write is triggered, causing the driver to crash
Applications dependent on the Athena connection experience service disruption

The vulnerability manifests during query data processing when the driver handles specially crafted input. This out-of-bounds write condition corrupts memory structures and causes the driver process to terminate unexpectedly. For detailed technical information, refer to the AWS Security Bulletin 2026-013.

Detection Methods for CVE-2026-35559

Indicators of Compromise

Unexpected crashes of the Amazon Athena ODBC driver process during query operations
Application error logs indicating memory access violations or segmentation faults in ODBC driver components
Repeated driver crashes following specific query patterns or data sources
Anomalous or malformed data appearing in query responses before driver failure

Detection Strategies

Monitor application logs for ODBC driver crash events, particularly those occurring during query execution phases
Implement crash dump analysis to identify memory corruption patterns consistent with out-of-bounds write conditions
Deploy endpoint detection solutions to alert on abnormal process termination of ODBC driver processes
Audit installed ODBC driver versions across the environment to identify instances running versions prior to 2.1.0.0

Monitoring Recommendations

Configure centralized logging to capture ODBC driver errors and crash reports from all systems using Amazon Athena connectivity
Establish baseline metrics for driver stability and alert on deviation from normal crash rates
Monitor network traffic for anomalous patterns in Athena query data that may indicate exploitation attempts

How to Mitigate CVE-2026-35559

Immediate Actions Required

Upgrade Amazon Athena ODBC driver to version 2.1.0.0 or later on all affected systems immediately
Inventory all systems using the Amazon Athena ODBC driver to ensure comprehensive patching coverage
Prioritize patching on systems handling critical analytics workloads or production data pipelines
Validate driver versions after upgrade to confirm successful remediation

Patch Information

Amazon has released version 2.1.0.0 of the Athena ODBC driver to address this vulnerability. Updated drivers are available for all supported platforms:

Windows: Amazon Athena ODBC Driver MSI for Windows
Linux: Amazon Athena ODBC Driver RPM
macOS (Intel): Amazon Athena ODBC Driver pkg (Intel)
macOS (ARM): Amazon Athena ODBC Driver pkg (ARM)

For complete release notes and additional details, refer to the AWS Athena ODBC Driver Release Notes.

Workarounds

Restrict network access to systems using the vulnerable ODBC driver to limit exposure to potential attack vectors
Implement input validation at the application layer to sanitize data before it reaches the ODBC driver
Consider temporarily using alternative connectivity methods (such as AWS SDK or JDBC drivers) if immediate patching is not feasible for critical systems

bash

# Verify installed ODBC driver version on Linux
rpm -qa | grep -i AmazonAthenaODBC
# Expected output for patched version: AmazonAthenaODBC-2.1.0.0

# Verify on Windows (PowerShell)
Get-ItemProperty "HKLM:\SOFTWARE\ODBC\ODBCINST.INI\Amazon Athena ODBC Driver" | Select-Object Driver, DriverODBCVer