Uncontrolled Memory Allocation in Amazon Ion-java
CVE-2026-75935

8.7HIGH

Key Information:

Vendor

Amazon Ion

Status
Amazon Ion Java
Vendor
CVE Published:
18 August 2026

What is CVE-2026-75935?

The vulnerability arises from uncontrolled memory allocation in the Ion stream cursor of Amazon Ion-java prior to version 1.12.0. This flaw may be exploited by remote actors by sending a specially crafted Ion binary document containing a declared-length field that could lead to excessive heap preallocation, potentially resulting in a denial of service. To mitigate this risk, it is recommended that users upgrade to version 1.12.0 or later.

Affected Version(s)

Amazon Ion Java 1.9.0 < 1.12.0

References

https://github.com/amazon-ion/ion-java/releases/tag/v1.12.0
patch
https://aws.amazon.com/security/security-bulletins/2026-0...
vendor-advisory
https://github.com/amazon-ion/ion-java/security/advisorie...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.