CVE-2026-75936: Memory-amplification denial of service via GZIP decompression bomb in Amazon ion-java
Improper handling of highly compressed data in the GZIP auto-decompression handler in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression.
To remediate this issue, users should upgrade to version 1.12.0 and configure withGzipDecompressionEnabled(false) and/or set an explicit withMaximumBufferSize() when parsing untrusted input.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Amazon ion-javato a version that resolves this vulnerability.Fixed in 1.12.0 - Configuration
When parsing untrusted input, disable the GZIP auto-decompression handler by configuring withGzipDecompressionEnabled(false).
Amazon ion-java withGzipDecompressionEnabled = false - Configuration
When parsing untrusted input, set an explicit withMaximumBufferSize() limit while reading Ion documents to prevent memory amplification from decompression bombs.
Amazon ion-java withMaximumBufferSize = explicit maximum
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Applications that parse untrusted Ion documents with GZIP auto-decompression enabled are exposed. A remote attacker can submit a crafted compressed document that expands to an arbitrarily large size and consumes memory, causing denial of service.
What does an attacker need to exploit this issue?
The attacker needs to be able to supply a crafted GZIP-compressed Ion document to a parsing path that uses the vulnerable auto-decompression handler. No additional prerequisites are stated.
What can be done if patching is not immediately possible?
Upgrade Amazon ion-java to version 1.12.0. For untrusted input, disable GZIP decompression with withGzipDecompressionEnabled(false) and/or configure an explicit limit using withMaximumBufferSize().