CVE-2026-85786: Incomplete fix for CVE-2026-75936 memory-amplification denial of service in Amazon ion-java
Improper handling of highly compressed data in Amazon ion-java before 1.12.1 might allow remote attackers to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression due to insufficient coverage of the GZIP auto-decompression opt-out introduced for CVE-2026-75936.
To remediate this issue, users should upgrade to version 1.12.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Amazon ion-javato a version that resolves this vulnerability.Fixed in 1.12.1
Event History
Frequently Asked Questions
Who is exposed to this denial-of-service issue?
Applications using Amazon ion-java versions before 1.12.1 that process attacker-controlled compressed Ion documents are exposed. The vulnerable behavior can be reached remotely and requires no attacker privileges or user interaction.
What does an attacker need to do to exploit it?
An attacker needs to supply a crafted compressed Ion document whose decompressed content expands to an arbitrarily large size. Processing that document can consume resources and cause a denial of service.
Is upgrading the recommended remediation?
Yes. Upgrade Amazon ion-java to version 1.12.1, which remediates the insufficient GZIP auto-decompression opt-out coverage.