Threat database

CVE-2026-75936 is a high-severity vulnerability in Amazon Ion Java before version 1.12.0. It involves improper handling of highly compressed data in the GZIP auto-decompression handler, which can lead to a denial of service when processing crafted compressed Ion documents that expand to very large sizes upon decompression. The issue can be mitigated by upgrading to version 1.12.0 and configuring the parser to disable GZIP decompression or limit buffer size when handling untrusted input.

Uncontrolled memory allocation in the binary Ion stream cursor in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted Ion binary document containing a declared-length field that causes excessive heap preallocation. To remediate this issue, users should upgrade to version 1.12.0.