CVE-2026-75936
Received Received - Intake

Denial of Service in Amazon ion-java via GZIP Decompression

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: AMZN

Description
Improper handling of highly compressed data in the GZIP auto-decompression handler in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression. To remediate this issue, users should upgrade to version 1.12.0 and configure withGzipDecompressionEnabled(false) and/or set an explicit withMaximumBufferSize() when parsing untrusted input.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-75936
EUVD
EUVD-2026-61174

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
amazon ion-java 1.12.0
amazon ion-java to 1.12.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-409 The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a memory-amplification denial of service vulnerability in Amazon ion-java, a Java library for the Amazon Ion data format. It occurs when highly compressed data is improperly handled during GZIP auto-decompression, causing the library to expand compressed Ion documents to an arbitrarily large size. This can exhaust system memory and disrupt service availability.

Detection Guidance

Detecting this vulnerability requires checking the version of Amazon ion-java in use. Commands like 'find / -name "ion-java*.jar" -exec grep -l "version" {} \;' or inspecting dependency files (e.g., Maven's pom.xml or Gradle's build.gradle) for ion-java versions prior to 1.12.0 can help identify exposure.

Impact Analysis

The vulnerability allows remote attackers to cause a denial of service by forcing excessive memory consumption. This can lead to system crashes, degraded performance, or complete unavailability of services relying on ion-java for parsing untrusted input.

Mitigation Strategies
  • Upgrade Amazon ion-java to version 1.12.0 or later to patch the vulnerability.
  • Configure a maximum buffer size using IonBufferConfiguration.withMaximumBufferSize to limit memory consumption.
  • Disable automatic GZIP decompression via IonReaderBuilder.withGzipDecompressionEnabled(false) when processing untrusted input.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75936. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart