AWS Updates Amazon Ion Python for Recursion Denial of Service
Tech GuruQuick Answer
AWS published 2026-122-AWS for Amazon Ion Python. AWS corrected uncontrolled recursion when the library processes a deeply nested, crafted Ion value, which can raise an error or crash an affected process and cause denial of service. AWS documents disabling the C extension and safely handling RecursionError as interim mitigations.
Confirm Scope And Apply The Supported Fix
What to do now: Identify Amazon Ion Python, match the exact affected release and exposed workflow, apply the supported fix, validate operations, and preserve change and investigation evidence.
Last verified: 2026-10-03 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Amazon Ion Python |
|---|---|
| Advisory | 2026-122-AWS |
| CVE | CVE-2026-104020 |
| Authoritative release date | 2026-10-01 20:30:00 UTC (AWS bulletin publication time) |
| Authority revision date | 2026-10-01 20:30:00 UTC (latest authority revision verified for this run) |
| Affected versions | Amazon Ion Python releases before 0.15.0. |
| Fixed version | Amazon Ion Python 0.15.0 |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
AWS corrected uncontrolled recursion when the library processes a deeply nested, crafted Ion value, which can raise an error or crash an affected process and cause denial of service.
What To Validate Now
- Inventory. Locate Amazon Ion Python deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Locate applications and services that import Amazon Ion Python, determine the installed package version, and identify paths that process untrusted or externally supplied Ion data.
- Remediate. Upgrade Amazon Ion Python to version 0.15.0. If an immediate upgrade is not possible, AWS says to disable the C extension with simpleion.c_ext=False and handle RecursionError safely.
- Validate. Confirm the resolved package and runtime version, exercise representative Ion parsing paths and error handling, monitor for recursion exceptions or process restarts, and retain dependency and test evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Disabling the C extension may change performance. Test latency, resource use, parsing compatibility, and service recovery before broad deployment; do not submit hostile samples to production.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
