CVE-2026-84851: CWE-674: Uncontrolled Recursion in Amazon ion-c

This vulnerability is an uncontrolled recursion issue (CWE-674) in Amazon Ion-C versions prior to 1.1.6. A remote unauthenticated attacker can craft malicious Ion data that causes the library to recurse excessively, exhausting the native call stack and crashing the application. This results in a denial of service condition. The CVSS v3.1 score is 7.5, reflecting network attack vector, low complexity, no privileges or user interaction required, and impact limited to availability. No known exploits are reported in the wild. The vendor advisory is available but does not explicitly state remediation status or patch availability.

Successful exploitation causes a denial of service by crashing the application using the vulnerable Ion-C library. There is no impact on confidentiality or integrity. The attack can be performed remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory at https://aws.amazon.com/security/security-bulletins/2026-094-aws/ for current remediation guidance. Until a patch is confirmed, consider mitigating by limiting exposure to untrusted Ion data inputs or applying runtime protections to prevent stack exhaustion.