Executive brief
Amazon ion-java is a Java library that parses and processes Amazon Ion data format files, widely used in AWS services and applications. A memory amplification vulnerability allows attackers to send highly compressed malicious Ion data that expands to consume excessive memory when processed, causing the application to crash or become unresponsive. The fix released in version 1.12.0 for a prior vulnerability (CVE-2026-75936) was incomplete, leaving systems running versions before 1.12.1 still vulnerable to denial of service attacks.
Technical details
CVE-2026-85786 is a memory-amplification denial of service vulnerability in Amazon ion-java that allows unauthenticated remote attackers to crash applications processing Ion data. The vulnerability arises from incomplete mitigation of CVE-2026-75936; while version 1.12.0 introduced a GZIP auto-decompression opt-out mechanism, this implementation did not adequately prevent expansion attacks. An attacker can craft highly compressed Ion payloads that expand to enormous sizes in memory when processed, overwhelming system resources and causing denial of service. The vulnerability is remotely exploitable over the network without authentication. A patch addressing the incomplete fix is available in ion-java version 1.12.1 and later.
Affected products
- Amazon ion-java < 1.12.1
CVE identifiers
- CVE-2026-75936
- CVE-2026-85786