CVE-2026-84851- Uncontrolled recursion in the Ion reader in Amazon Ion-C before 1.1.6
Ion ยท 2026-10-21
Actions
Technical Details
| Affected Versions | < 1.1.6 |
|---|---|
| Regions | all |
| CVE IDs | CVE-2026-84851 |
| Migration Required | Yes |
| Cost Impact | Neutral |
| IaC Impact | High |
What This Means
For DevOps Teams
Update applications using Amazon Ion-C to version 1.1.6 to address the uncontrolled recursion vulnerability (CVE-2026-84851) and prevent potential crashes due to stack overflow.
For Platform Teams
Deploy the updated Amazon Ion-C library with the enforced recursion depth limit to enhance application resilience against denial of service attacks.
For Executives
Implement the upgrade to Amazon Ion-C version 1.1.6 to mitigate the risk of denial of service attacks due to uncontrolled recursion, ensuring application stability and security.
Source
Related Ion Updates
- CVE-2026-75935 and CVE-2026-75936 - Issue with Amazon ion-java - Memory-amplification denial of service (2026-10-21)
- CVE-2026-85786 - Incomplete fix for CVE-2026-75936 memory-amplification denial of service in Amazon ion-java (2026-10-21)
- Amazon SageMaker AI now supports serverless model customization for NVIDIA Nemotron 3.5 Lightning (2026-09-16)