Improper Handling of Compressed Data in Amazon ion-java Products
CVE-2026-75936

8.7HIGH

Key Information:

Vendor

Amazon Ion

Status
Amazon Ion Java
Vendor
CVE Published:
18 August 2026

What is CVE-2026-75936?

The Amazon ion-java library prior to version 1.12.0 is susceptible to a vulnerability where improper handling of highly compressed data in the GZIP auto-decompression handler may allow attackers to exploit the system. By crafting a specific compressed Ion document, remote actors could trigger a denial of service condition, resulting in the expanded data consuming excessive memory resources during decompression. To mitigate this risk, it is recommended that users upgrade to version 1.12.0 and adjust their configurations using GzipDecompressionEnabled(false) and/or by setting a specific withMaximumBufferSize() for parsing any untrusted input.

Affected Version(s)

Amazon Ion Java 0 < 1.12.0

References

https://github.com/amazon-ion/ion-java/releases/tag/v1.12.0
patch
https://github.com/amazon-ion/ion-java/security/advisorie...
third-party-advisory
https://aws.amazon.com/security/security-bulletins/2026-0...
vendor-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.