CVE-2026-104020

Executive Summary

CVE-2026-104020 is a denial-of-service vulnerability in the Amazon Ion Python library affecting versions prior to 0.15.0. An unauthenticated remote actor can trigger uncontrolled recursion in the Ion reader by supplying a crafted, deeply nested Ion value, causing application crash via stack exhaustion. Any service that parses untrusted Ion-formatted input using the affected library is at risk.

Technical Analysis

The vulnerability is classified as CWE-674: Uncontrolled Recursion. The flaw resides in the Ion reader component of Amazon Ion Python. Ion is a data serialization format that supports arbitrarily nested container types (structs, lists, and s-expressions). When the Ion reader parses a document, nested containers are processed using recursion. If recursion depth is not bounded or capped, a crafted input containing deeply nested Ion values forces the parser to recurse far beyond the limits of the Python interpreter's call stack.

Python's default recursion limit (typically 1000 frames) combined with the C stack limit means that excessive recursive descent raises a RecursionError, or in more severe cases, results in a hard interpreter crash (segmentation fault) when the C-level stack is exhausted before Python's own guard triggers. Because the Ion reader processes attacker-supplied data, the recursion depth is fully attacker-controlled. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H confirms this is network-reachable, low-complexity, requires no privileges or user interaction, and results in a complete availability impact with no confidentiality or integrity impact.

The attack surface is any application endpoint, message queue consumer, file ingestion pipeline, or API handler that deserializes untrusted Ion content. No patch evidence is available from any tracked source at this time; the fix described in the advisory is a version upgrade to 0.15.0.

Exploitation Scenarios

No public PoC is available for CVE-2026-104020; the attack chain below is inferred from the vulnerability class (CWE-674) and the NVD description.

1. Reconnaissance / target identification: An attacker identifies a target application that consumes Ion-formatted data. This may be exposed through a REST API accepting Ion payloads, a file upload or import feature, a message broker consumer (e.g., streaming serialized Ion records), or a configuration/log ingestion path. Fingerprinting can be aided by observing Content-Type headers referencing Ion media types or by error responses that reveal Ion parsing behavior.

2. Triggering the flaw class: The attacker crafts an Ion document containing a pathologically deep nesting of container values (e.g., nested structs/lists/s-expressions opened sequentially). Each opening delimiter drives the reader one level deeper into recursion. By nesting thousands of levels, the attacker drives the parser's recursive descent past the interpreter's stack limit.

3. Payload / execution method: The crafted Ion value is delivered to the vulnerable parsing endpoint as the request body or as an ingested document. Because the parser recurses while reading the input, the call stack is exhausted during parsing — no valid semantic content is required beyond the deep nesting itself. The delivery is a single network request, consistent with AV:N/AC:L/PR:N/UI:N.

4. Post-exploitation impact: Successful trigger raises RecursionError and/or crashes the worker process handling the request. In a multi-worker or containerized deployment this causes request failures and potential container restarts; if the crash reaches the C stack, it can terminate the process outright. Repeated requests sustain the denial of service. There is no code execution, data exfiltration, or integrity impact (C:N/I:N per the CVSS vector) — impact is limited to availability.

Impact Assessment

Per the CVSS 3.1 base score of 7.5 (High), the attack is network-exploitable with low complexity, requires no privileges and no user interaction, and has a complete availability impact (A:H) with no confidentiality (C:N) or integrity (I:N) impact. Scope is unchanged.

Business impact centers on service disruption: applications that parse untrusted Ion — API gateways, data-ingestion pipelines, event consumers, and batch processors — can be taken offline by a trivially generated request. In CI/CD or data platforms, crash loops can stall pipelines and cause data processing backlogs. Because exploitation is low-effort and requires only a malformed document, the vulnerability is attractive for opportunistic denial-of-service against internet-facing services. Blast radius is bounded to the process consuming the malformed input; however, a single malformed message in a shared queue can repeatedly crash successive consumers, producing a persistent outage pattern.

Detection Guidance

Sigma Rule

title: Amazon Ion Python Deeply Nested Value DoS Attempt (CVE-2026-104020)
id: 8f2a1c44-7b1e-4d3a-9c11-4a5e6f7d8a90
status: experimental
description: Detects application crashes consistent with uncontrolled recursion in the Ion reader triggered by deeply nested Ion input.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-104020
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: application
  product: python
detection:
  selection:
    message|contains:
      - 'RecursionError'
      - 'maximum recursion depth exceeded'
  condition: selection
falsepositives:
  - Legitimate deep recursion in unrelated application code
level: medium

YARA Rule

rule CVE_2026_104020_Ion_Deep_Nesting
{
    meta:
        description = "Detects deeply nested Ion container sequences consistent with CVE-2026-104020"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-104020"
        author = "Threat Intelligence"
        date = "2026-01-01"
    strings:
        $open_struct = "{"
        $open_list   = "["
        $open_sexp   = "("
    condition:
        2 of them and #open_struct > 500 or #open_list > 500 or #open_sexp > 500
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-104020 Amazon Ion Python Deeply Nested Value DoS Attempt"; flow:established,to_server; http.request_body; content:"{"; depth:0; pcre:"/\{(\{|\[|\()(\{|\[|\()(\{|\[|\()(\{|\[|\()(\{|\[|\()(\{|\[|\()(\{|\[|\()(\{|\[|\()(\{|\[|\()(\{|\[|\()/"; reference:cve,2026-104020; classtype:attempted-dos; sid:1040200; rev:1;)

Elastic Detection

process where event.type == "start" and process.name : "python*" and
  process.args : "*ion*" and
  message : ("RecursionError", "maximum recursion depth exceeded")

Splunk SPL Query

index=application_logs ("RecursionError" OR "maximum recursion depth exceeded")
| stats count by host, source, process
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="amazon_ion,cve_2026_104020,">
  <rule id="104020" level="10">
    <decoded_as>json</decoded_as>
    <field name="message">RecursionError|maximum recursion depth exceeded</field>
    <description>CVE-2026-104020: Amazon Ion Python uncontrolled recursion DoS indicator detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence is available from any tracked source; the only remediation described in the advisory is a version upgrade.

1. Immediate mitigations

   • Restrict or disable ingestion of untrusted Ion input until upgraded; enforce strict input size and nesting-depth limits at the API gateway or ingestion layer where possible.
   • Run Ion-parsing services with process isolation and automatic restart (container restart policies, worker supervisors) to limit the duration of a crash-induced outage.
   • Increase logging/alerting on RecursionError and worker crashes to detect active exploitation attempts.
   • Apply network-layer filtering to limit unauthenticated access to endpoints that deserialize Ion content.

2. Patch / upgrade steps

   • Upgrade Amazon Ion Python to version 0.15.0 or later, which resolves the uncontrolled recursion in the Ion reader.
   • Verify the deployed version in all dependency manifests and lockfiles (e.g., via pip show amazon.ion or the equivalent package metadata query) and confirm the running version post-deploy.
   • Re-scan container images and dependency inventories after upgrade to confirm no affected version remains.

3. Long-term hardening

   • Adopt a policy of bounding recursion depth in all parsers handling untrusted serialized data, and prefer iterative parsing where feasible.
   • Implement resource limits (maximum document size, maximum nesting depth) at the deserialization boundary as defense in depth.
   • Maintain continuous dependency monitoring to catch advisories for serialization libraries promptly.

References

• NVD — CVE-2026-104020: https://nvd.nist.gov/vuln/detail/CVE-2026-104020
• CWE-674: Uncontrolled Recursion — https://cwe.mitre.org/data/definitions/674.html
• Amazon Ion Python project repository and release notes (version 0.15.0)
• FIRST.org EPSS (not yet scored for this CVE)
• CISA Known Exploited Vulnerabilities Catalog — not listed as of this report

No public exploit code, Nuclei template, or PoC was identified. No threat actor campaigns or exploit-in-the-wild evidence were reported in the available data.