CVE-2026-75936
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
Amazon ion-java before version 1.12.0 improperly handles highly compressed data in the GZIP auto-decompression handler, which may allow remote actors to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression.
Risk Assessment
The risk includes resource exhaustion and service unavailability, potentially impacting the continuity of applications using ion-java.
Recommendation
Upgrade to version 1.12.0 and configure withGzipDecompressionEnabled(false) and/or set an explicit withMaximumBufferSize() when parsing untrusted input.
Other vulnerabilities in Amazon ion-java
See all- CVE-2026-85786High
Amazon ion-java before 1.12.1 improperly handles highly compressed data, potentially allowing remote attackers to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression due to insufficient coverage of the GZIP auto-decompression opt-out introduced for CVE-2026-75936.
- CVE-2026-75935High
Amazon ion-java before version 1.12.0 has uncontrolled memory allocation in the binary Ion stream cursor, which may allow remote actors to cause a denial of service via a crafted Ion binary document containing a declared-length field that causes excessive heap preallocation.
Original NVD description (English source)
Improper handling of highly compressed data in the GZIP auto-decompression handler in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression. To remediate this issue, users should upgrade to version 1.12.0 and configure withGzipDecompressionEnabled(false) and/or set an explicit withMaximumBufferSize() when parsing untrusted input.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS