Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-75935

Memory-amplification denial of service via declared-length preallocation in Amazon ion-java

Uncontrolled memory allocation in the binary Ion stream cursor in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted Ion binary document containing a declared-length field that causes excessive heap preallocation. To remediate this issue, users should upgrade to version 1.12.0.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Amazon Amazon Ion
Products
Ion Amazon Ion Java
CVE-2026-75936

Memory-amplification denial of service via GZIP decompression bomb in Amazon ion-java

Improper handling of highly compressed data in the GZIP auto-decompression handler in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression. To remediate this issue, users should upgrade to version 1.12.0 and configure withGzipDecompressionEnabled(false) and/or set an explicit withMaximumBufferSize() when parsing untrusted input.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Amazon Ion
Products
Amazon Ion Java