CVE-2026-84851: Uncontrolled recursion in the Ion reader in Amazon Ion-C before 1.1.6

Q: Who is exposed to this issue?

Applications using Amazon Ion-C versions earlier than 1.1.6 are exposed if they process attacker-controlled Ion data. The affected code is the Ion reader, and exploitation can be performed remotely without authentication or user interaction.

Q: What is the impact of successful exploitation?

A crafted Ion input can trigger uncontrolled recursion that exhausts the native call stack. This crashes the application using the library, causing a denial of service; no confidentiality or integrity impact is stated.

Q: What version fixes the issue?

Upgrade Amazon Ion-C to version 1.1.6 or later. Versions before 1.1.6 are affected.

Published Sep 2, 2026

Updated

An uncontrolled recursion issue exists in Amazon Ion-C versions before 1.1.6 that might allow a remote unauthenticated actor to craft Ion data that exhausts the native call stack and crashes the application using the library, resulting in a denial of service.

Affected Software

1 affected component

Amazon Ion-C<1.1.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Amazon Ion-C to a version that resolves this vulnerability.
Fixed in 1.1.6

Event History

Sep 2, 2026

CVE Published

via MITRE·08:19 PM

Data Sourced

via MITRE·08:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Applications using Amazon Ion-C versions earlier than 1.1.6 are exposed if they process attacker-controlled Ion data. The affected code is the Ion reader, and exploitation can be performed remotely without authentication or user interaction.

What is the impact of successful exploitation?