CVE-2025-11573: CWE-1286: Improper Validation of Syntactic Correctness of Input in Amazon Amazon.IonDotnet
Bulletin ID: AWS-2025-022 Scope: Amazon Content Type: Important (requires attention) Publication Date: 2025/10/09 11:00 PM PDT Description: Amazon.IonDotnet is a library for the Dotnet language that is used to read and write Amazon Ion data. We identified CVE-2025-11573, which describes an infinite loop issue in Amazon.IonDotnet library versions <v1.3.2 that may allow a threat actor to cause a denial of service through a specially crafted text input. As of August 20, 2025, this library has been deprecated and will not receive further updates. Affected versions: <1.3.2
AI Analysis
Technical Summary
The vulnerability CVE-2025-11573 affects Amazon.IonDotnet library versions before v1.3.2. It is caused by improper validation of syntactic correctness of input data, leading to an infinite loop during processing of maliciously crafted text input. This infinite loop can cause the application using the library to become unresponsive, resulting in a denial of service. The CVSS 4.0 score of 8.7 reflects the high severity and network attack vector with no required privileges or user interaction. The recommended remediation is to upgrade to version v1.3.2 or later where the issue is fixed.
Potential Impact
Exploitation of this vulnerability can cause a denial of service condition by triggering an infinite loop in the Amazon.IonDotnet library when processing specially crafted input. This can disrupt availability of applications relying on the affected library. There are no known exploits in the wild at this time. The vulnerability does not require privileges or user interaction to be exploited.
Mitigation Recommendations
A fix is available by upgrading to Amazon.IonDotnet version v1.3.2 or later. Users should apply this update to remediate the vulnerability. No other mitigation or temporary workaround is indicated in the available data.
CVE-2025-11573: CWE-1286: Improper Validation of Syntactic Correctness of Input in Amazon Amazon.IonDotnet
Description
Bulletin ID: AWS-2025-022 Scope: Amazon Content Type: Important (requires attention) Publication Date: 2025/10/09 11:00 PM PDT Description: Amazon.IonDotnet is a library for the Dotnet language that is used to read and write Amazon Ion data. We identified CVE-2025-11573, which describes an infinite loop issue in Amazon.IonDotnet library versions <v1.3.2 that may allow a threat actor to cause a denial of service through a specially crafted text input. As of August 20, 2025, this library has been deprecated and will not receive further updates. Affected versions: <1.3.2
CVSS v4.0
Score 8.7high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2025-11573 affects Amazon.IonDotnet library versions before v1.3.2. It is caused by improper validation of syntactic correctness of input data, leading to an infinite loop during processing of maliciously crafted text input. This infinite loop can cause the application using the library to become unresponsive, resulting in a denial of service. The CVSS 4.0 score of 8.7 reflects the high severity and network attack vector with no required privileges or user interaction. The recommended remediation is to upgrade to version v1.3.2 or later where the issue is fixed.
Potential Impact
Exploitation of this vulnerability can cause a denial of service condition by triggering an infinite loop in the Amazon.IonDotnet library when processing specially crafted input. This can disrupt availability of applications relying on the affected library. There are no known exploits in the wild at this time. The vulnerability does not require privileges or user interaction to be exploited.
Mitigation Recommendations
A fix is available by upgrading to Amazon.IonDotnet version v1.3.2 or later. Users should apply this update to remediate the vulnerability. No other mitigation or temporary workaround is indicated in the available data.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- AMZN
- Date Reserved
- 2025-10-09T17:32:12.383Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 68e7fa08ba0e608b4fa8ce46
Added to database: 10/09/2025, 18:08:08 UTC
Last enriched: 06/05/2026, 19:28:50 UTC
Last updated: 08/19/2026, 22:52:06 UTC
Views: 188
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.