CVE-2026-75935

Awaiting Analysis Awaiting Analysis - Queue

Memory Allocation DoS in Amazon Ion Java

Publication date: 2026-08-18

Last updated on: 2026-08-19

Assigner: AMZN

Description

Uncontrolled memory allocation in the binary Ion stream cursor in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted Ion binary document containing a declared-length field that causes excessive heap preallocation. To remediate this issue, users should upgrade to version 1.12.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-19

Generated

2026-09-08

AI Q&A

2026-08-18

EPSS Evaluated

2026-09-07

NVD

CVE-2026-75935

EUVD

EUVD-2026-61173

Affected Vendors & Products

Vendor	Product	Version / Range
amazon	ion-java	1.12.0
amazon	ion-java	From 1.9.0 (inc) to 1.12.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-789	The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability involves uncontrolled memory allocation in the Amazon ion-java library before version 1.12.0. A remote attacker could exploit it by sending a specially crafted Ion binary document with a declared-length field, causing excessive heap preallocation and potentially leading to a denial of service.

Detection Guidance

Detecting this vulnerability requires checking the version of the Amazon ion-java library in use. If the version is between 1.9.0 and 1.12.0, the system is potentially vulnerable. Commands to check the version include examining dependency files like pom.xml or build.gradle for Maven/Gradle projects, or using commands like 'mvn dependency:tree' or 'gradle dependencies' to inspect the library version.

Impact Analysis

The vulnerability could allow attackers to crash applications or services using affected versions of Amazon ion-java by consuming excessive memory, disrupting normal operations and causing downtime.

Compliance Impact

This vulnerability primarily impacts system availability by causing denial of service through excessive memory allocation. While it does not directly affect data confidentiality or integrity, prolonged unavailability could potentially lead to compliance violations under standards like GDPR or HIPAA that require timely access to personal or health data. However, the provided context does not specify direct compliance impacts.

Mitigation Strategies

Upgrade the Amazon ion-java library to version 1.12.0 or later to address the uncontrolled memory allocation issue.

Hi! I’m here to help you understand CVE-2026-75935. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70