Executive brief
Amazon ion-java is a Java library used to parse and handle Ion data format, which is commonly used in AWS services and data processing pipelines. The library contains two denial-of-service vulnerabilities that allow attackers to cause excessive memory allocation, potentially crashing applications or consuming server resources through specially crafted Ion data. An attacker could exploit these flaws to disrupt service availability by sending malicious Ion-formatted data to any application using vulnerable versions of the library.
Technical details
CVE-2026-75935 and CVE-2026-75936 are memory-amplification denial-of-service vulnerabilities in ion-java, a library that parses Ion data format. The first vulnerability exploits declared-length preallocation, where an attacker provides a maliciously large declared size that causes the parser to preallocate excessive memory. The second vulnerability abuses highly compressed data that expands dramatically during decompression. Both attacks are network-reachable; they require no authentication but do require sending crafted Ion-formatted data to an application using the vulnerable library. An attacker can achieve denial of service by exhausting server memory or CPU resources. The vulnerabilities affect all versions before 1.12.0, and a patch is available in version 1.12.0 and later.
Affected products
- Amazon ion-java < 1.12.0
CVE identifiers
- CVE-2026-75936
- CVE-2026-75935
Timeline
- 2026-08-18: disclosed
- 2026-09-09: advisory