In plain language
What this advisory means
Amazon Ion-C is a library used by applications to read and write Amazon Ion data in C language. A vulnerability was found in versions before 1.1.6 where specially crafted Ion data can cause the software to crash by exhausting system resources, leading to a denial of service. This could be done remotely without authentication.
Technical explanation
How the issue affects the environment
The issue, tracked as CVE-2026-84851, is due to uncontrolled recursion in the Ion reader component of Amazon Ion-C versions before 1.1.6. Maliciously crafted Ion data can cause infinite or excessively deep recursive calls, exceeding the native call stack limit and causing the application using the library to crash. This leads to a denial of service condition. The fix involves enforcing a default recursion depth limit that raises an error (IERR_STACK_OVERFLOW) when exceeded, enabling error handling and preventing crashes.
Operational impact
Why teams should care
Applications embedding Amazon Ion-C versions prior to 1.1.6 are susceptible to denial of service attacks by remote, unauthenticated actors. This can cause service downtime, disrupting business operations, harming user experience, and potentially damaging reputation. Preventing crashes is critical to maintain service availability and reliability.
Immediate action
Upgrade Amazon Ion-C to version 1.1.6 or later. This update enforces a recursion depth limit, preventing uncontrolled recursion and enabling applications to handle stack overflow errors gracefully. Also ensure any forked or derivative code incorporates this fix.
Affected and fixed releases
Temporary risk reduction
Prior to version 1.1.6, avoid using the ion-c APIs that automatically rewrite data read by an ion_reader, such as ion_writer_write_one_value and ion_writer_write_all_values. Instead, manually traverse the value tree using iterative or recursion with a manually enforced depth limit to avoid unbounded recursion.
Evidence and validation checklist
- AWS Security Bulletin 2026-094-AWS detailing CVE-2026-84851
- Description of uncontrolled recursion causing call stack exhaustion and denial of service
- Publication stating issue fixed in version 1.1.6 with recursion depth limits
- Recommendations to upgrade and manual workarounds prior to fix
Authoritative reference
AWS Security Bulletins
QCS detected and normalized this record from the official source. Vendor guidance remains authoritative.