Amazon Ion vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Amazon Ion products: 2 record(s), with severity, exploitation and fixes.

Amazon Ion Java 2

Exploited only (KEV) →

CVE-2026-75936 High · 7.5 CWE-409 Aug 18, 2026

Memory-amplification denial of service via GZIP decompression bomb in Amazon ion-java

Improper handling of highly compressed data in the GZIP auto-decompression handler in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression. To remediate this issue, users should upgrade to version 1.12.0 and configure withGzipDecompressionEnabled(false) and/or set an explicit withMaximumBufferSize() when parsing untrusted input.

CVE-2026-75935 High · 7.5 CWE-789 Aug 18, 2026

Memory-amplification denial of service via declared-length preallocation in Amazon ion-java

Uncontrolled memory allocation in the binary Ion stream cursor in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted Ion binary document containing a declared-length field that causes excessive heap preallocation. To remediate this issue, users should upgrade to version 1.12.0.