CVE-2026-85786
Received Received - Intake

Denial of Service in Amazon ion-java

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: AMZN

Description
Improper handling of highly compressed data in Amazon ion-java before 1.12.1 might allow remote attackers to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression due to insufficient coverage of the GZIP auto-decompression opt-out introduced for CVE-2026-75936. To remediate this issue, users should upgrade to version 1.12.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-05
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85786
EUVD
EUVD-2026-71714

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
amazon ion-java 1.12.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-409 The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves improper handling of highly compressed data in Amazon ion-java versions before 1.12.1. Attackers can exploit it by sending a crafted compressed Ion document that expands to an extremely large size during decompression, causing a denial of service due to insufficient protection against GZIP auto-decompression.

Detection Guidance

This vulnerability involves improper handling of compressed data in Amazon ion-java. Detection would require checking for unusually large decompressed data sizes from Ion documents, particularly those using GZIP compression. No specific commands are provided in the context, but monitoring for excessive memory usage during Ion document processing could indicate exploitation.

Impact Analysis

This vulnerability could allow remote attackers to crash systems or applications using affected versions of Amazon ion-java by sending maliciously crafted data that consumes excessive resources during decompression.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling denial-of-service attacks through crafted compressed data, which may disrupt services handling sensitive personal or health information. Insufficient coverage of GZIP auto-decompression could lead to resource exhaustion, affecting availability of critical systems.

Mitigation Strategies

Upgrade to Amazon ion-java version 1.12.1 or later to address the improper handling of compressed data that could lead to denial of service.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85786. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart