Amazon Ion Java vulnerabilities

2 known vulnerabilities in Amazon Ion Java from Amazon Ion. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Amazon Ion Java: Improper Handling of Highly Compressed Data (Data Amplification)

  CVE-2026-75936Aug 18, 2026Amazon Ion

  Improper handling of highly compressed data in the GZIP auto-decompression handler in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon deco

• 7.5 High severity

  Amazon Ion Java: Memory Allocation with Excessive Size Value

  CVE-2026-75935Aug 18, 2026Amazon Ion

  Uncontrolled memory allocation in the binary Ion stream cursor in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted Ion binary document containing a declared-length field that causes excessive heap preallocation