CVE-2026-75936: CWE-409 (Improper Handling of Highly Compressed Data) in Amazon Ion Amazon Ion Java
CVE-2026-75936 is a critical vulnerability in Amazon Ion Java before version 1.12.0 involving improper handling of highly compressed data in the GZIP auto-decompression handler. This flaw allows remote attackers to cause a denial of service by submitting a crafted compressed Ion document that expands to an arbitrarily large size upon decompression. The vulnerability is identified as CWE-409 (Improper Handling of Highly Compressed Data).
AI Analysis
Technical Summary
The vulnerability CVE-2026-75936 affects Amazon Ion Java versions before 1.12.0. It arises from improper handling of highly compressed data in the GZIP auto-decompression handler, which can be exploited by remote actors to cause a denial of service (DoS) condition. Specifically, a crafted compressed Ion document can expand to an arbitrarily large size during decompression, exhausting system resources. The recommended remediation is to upgrade to version 1.12.0 and configure the parser to disable GZIP decompression (withGzipDecompressionEnabled(false)) and/or set an explicit maximum buffer size (withMaximumBufferSize()) when processing untrusted input.
Potential Impact
Successful exploitation results in a denial of service due to resource exhaustion caused by decompression of maliciously crafted compressed Ion documents. This can disrupt availability of applications using vulnerable versions of Amazon Ion Java.
Mitigation Recommendations
Users should upgrade to Amazon Ion Java version 1.12.0 or later. Additionally, when parsing untrusted input, configure the parser to disable GZIP auto-decompression by setting withGzipDecompressionEnabled(false) and/or specify an explicit maximum buffer size using withMaximumBufferSize(). Patch status is not explicitly stated, but upgrading to 1.12.0 is the recommended fix.
CVE-2026-75936: CWE-409 (Improper Handling of Highly Compressed Data) in Amazon Ion Amazon Ion Java
Description
CVE-2026-75936 is a critical vulnerability in Amazon Ion Java before version 1.12.0 involving improper handling of highly compressed data in the GZIP auto-decompression handler. This flaw allows remote attackers to cause a denial of service by submitting a crafted compressed Ion document that expands to an arbitrarily large size upon decompression. The vulnerability is identified as CWE-409 (Improper Handling of Highly Compressed Data).
CVSS v4.0
Score 9.9critical
Affected software
pkg:maven/com.amazon.ion/ion-javaRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2026-75936 affects Amazon Ion Java versions before 1.12.0. It arises from improper handling of highly compressed data in the GZIP auto-decompression handler, which can be exploited by remote actors to cause a denial of service (DoS) condition. Specifically, a crafted compressed Ion document can expand to an arbitrarily large size during decompression, exhausting system resources. The recommended remediation is to upgrade to version 1.12.0 and configure the parser to disable GZIP decompression (withGzipDecompressionEnabled(false)) and/or set an explicit maximum buffer size (withMaximumBufferSize()) when processing untrusted input.
Potential Impact
Successful exploitation results in a denial of service due to resource exhaustion caused by decompression of maliciously crafted compressed Ion documents. This can disrupt availability of applications using vulnerable versions of Amazon Ion Java.
Mitigation Recommendations
Users should upgrade to Amazon Ion Java version 1.12.0 or later. Additionally, when parsing untrusted input, configure the parser to disable GZIP auto-decompression by setting withGzipDecompressionEnabled(false) and/or specify an explicit maximum buffer size using withMaximumBufferSize(). Patch status is not explicitly stated, but upgrading to 1.12.0 is the recommended fix.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- AMZN
- Date Reserved
- 2026-08-18T15:50:51.183Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a84b773c6e8be0332ab79d0
Added to database: 08/18/2026, 19:50:11 UTC
Last enriched: 08/18/2026, 20:04:20 UTC
Last updated: 08/19/2026, 04:08:59 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.