CVE-2026-75935 and CVE-2026-75936 - Issue with Amazon ion-java - Memory-amplification denial of service
Ion ยท 2026-09-09
Actions
Technical Details
| Affected Versions | < 1.12.0 |
|---|---|
| Regions | all |
| CVE IDs | CVE-2026-75935, CVE-2026-75936 |
| Migration Required | Yes |
| Cost Impact | Neutral |
| IaC Impact | High |
What This Means
For DevOps Teams
Update ion-java to version 1.12.0, configure a limited maximum buffer size, and disable automatic GZIP decompression for untrusted input to address critical security vulnerabilities (CVE-2026-75935 and CVE-2026-75936).
For Platform Teams
Deploy the updated ion-java version 1.12.0 across all relevant services to eliminate security risks associated with memory-amplification denial of service vulnerabilities (CVE-2026-75935 and CVE-2026-75936).
For Executives
Implement the latest ion-java version 1.12.0 to mitigate memory-amplification denial of service vulnerabilities (CVE-2026-75935 and CVE-2026-75936) and ensure system security and stability.
Source
Related Ion Updates
- CVE-2026-85786 - Incomplete fix for CVE-2026-75936 memory-amplification denial of service in Amazon ion-java (2026-09-09)
- CVE-2026-84851- Uncontrolled recursion in the Ion reader in Amazon Ion-C before 1.1.6 (2026-09-09)
- CVE-2026-85786 - Incomplete fix for CVE-2026-75936 memory-amplification denial of service in Amazon ion-java (2026-09-04)
- CVE-2026-84851- Uncontrolled recursion in the Ion reader in Amazon Ion-C before 1.1.6 (2026-09-02)
- CVE-2026-75935 and CVE-2026-75936 - Issue with Amazon ion-java - Memory-amplification denial of service (2026-08-20)