To remediate this issue, users should upgrade to version 1.12.0 and configure withGzipDecompressionEnabled(false) and/or set an explicit withMaximumBufferSize() when parsing untrusted input.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Amazon Ion | Amazon Ion Java | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
| Link | Providers |
|---|---|
| https://github.com/amazon-ion/ion-java/releases/tag/v1.12.0 |
|
Tue, 18 Aug 2026 19:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Improper handling of highly compressed data in the GZIP auto-decompression handler in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression. To remediate this issue, users should upgrade to version 1.12.0 and configure withGzipDecompressionEnabled(false) and/or set an explicit withMaximumBufferSize() when parsing untrusted input. | |
| Title | Memory-amplification denial of service via GZIP decompression bomb in Amazon ion-java | |
| First Time appeared |
Amazon Ion
Amazon Ion amazon Ion Java |
|
| Weaknesses | CWE-409 | |
| CPEs | cpe:2.3:a:amazon_ion:amazon_ion_java:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Amazon Ion
Amazon Ion amazon Ion Java |
|
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: AMZN
Published:
Updated: 2026-08-18T19:52:20.092Z
Reserved: 2026-08-18T15:50:51.183Z
Link: CVE-2026-75936
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.