CVE-2026-75935: Memory-amplification denial of service via declared-length preallocation in Amazon ion-java
Uncontrolled memory allocation in the binary Ion stream cursor in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted Ion binary document containing a declared-length field that causes excessive heap preallocation.
To remediate this issue, users should upgrade to version 1.12.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Amazon ion-javato a version that resolves this vulnerability.Fixed in 1.12.0
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Systems that parse Ion binary documents from remote or otherwise untrusted sources are exposed. An unauthenticated remote actor can send a crafted document that triggers excessive heap preallocation and causes denial of service.
What does an attacker need to exploit this issue?
The vulnerable binary Ion stream cursor must process a crafted Ion binary document with a declared-length field designed to cause excessive allocation. No privileges or user interaction are required according to the provided severity vector.
What is the remediation?
Upgrade Amazon ion-java to version 1.12.0. The provided data does not specify an alternative mitigation for environments where an upgrade cannot be performed immediately.