CVE-2026-104020

HighCVSS 7.5/10Last modified Oct 2, 2026

Description

Uncontrolled recursion in the Ion reader in Amazon Ion Python before 0.15.0 might allow a remote unauthenticated actor to crash the application using the library, resulting in a denial of service, via a crafted, deeply nested Ion value.

To remediate this issue, users should upgrade to version 0.15.0 or later.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-674

Affected software

Vendor	Product	Versions
Amazon	ion-python	< 0.15.0

References

Timeline

Published: Oct 1, 2026
Last modified: Oct 2, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1040217.2The Fastcache by Host.it plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 1.7.4 via the `fastcache CVE-2026-1040225.4The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to Privilege Escalation in all ver CVE-2026-1040234.9The Smart Popup by Supsystic plugin for WordPress is vulnerable to generic SQL Injection via the 'sidx' parameter in all versions up to, and CVE-2026-1040244.6Incomplete List of Disallowed Inputs (CWE-184) in the dangerous-extension confirmation of the archive object viewer (peach.pas, grid_obj_ope CVE-2026-1040258.4Path Traversal (CWE-22) in the execute_obj function of the archive object viewer (peach.pas) in PeaZip 11.2.0 and earlier on Windows allows CVE-2026-1040267.8In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to be embedded in Git subtree URLs. A maliciously constructed CVE-2026-1040289.8The Anton Extensions WordPress plugin through 1.2.2 does not perform any capability check, nonce verification, or file-type validation befor CVE-2026-1040293.3A flaw was found in SSSD. A local attacker can exploit this vulnerability by sending a specially crafted request to the autofs responder UNI CVE-2026-1040305.5A flaw was found in sssd. This vulnerability allows a local user to cause a Denial of Service (DoS) by submitting a specially crafted passke CVE-2026-1040315.5A flaw was found in SSSD. In configurations where the autofs responder service is enabled, memory allocated during successful request proces CVE-2026-1040325.5A flaw was found in SSSD. An unprivileged local user can repeatedly request master automount map updates through the autofs responder due to CVE-2026-1040335.4A flaw was found in SSSD. When configured to enforce account expiration using LDAP (Lightweight Directory Access Protocol) shadow attributes