CVE-2026-75935
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
Amazon ion-java before version 1.12.0 has uncontrolled memory allocation in the binary Ion stream cursor, which may allow remote actors to cause a denial of service via a crafted Ion binary document containing a declared-length field that causes excessive heap preallocation.
Risk Assessment
The risk includes memory exhaustion and service unavailability, potentially leading to application crashes in systems using ion-java.
Recommendation
Upgrade to version 1.12.0, which includes the fix limiting memory allocation.
Original NVD description (English source)
Uncontrolled memory allocation in the binary Ion stream cursor in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted Ion binary document containing a declared-length field that causes excessive heap preallocation. To remediate this issue, users should upgrade to version 1.12.0.