SB2026081970 - Multiple vulnerabilities in ion-java

Description

This security bulletin contains information about 2 vulnerabilities.

1) Improper handling of highly compressed data (CVE-ID: CVE-2026-75936)

CWE-ID: CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of highly compressed data in the GZIP auto-decompression handler when parsing crafted compressed Ion documents. A remote attacker can send a specially crafted compressed Ion document to cause a denial of service.

The issue is triggered when the compressed input expands to an arbitrarily large size upon decompression.

2) Uncontrolled Memory Allocation (CVE-ID: CVE-2026-75935)

CWE-ID: CWE-789 - Uncontrolled Memory Allocation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to memory allocation with excessive size value in the binary Ion stream cursor when parsing a crafted Ion binary document with a declared-length field. A remote attacker can send a specially crafted Ion binary document to cause a denial of service.

The issue can trigger excessive heap preallocation based on the declared length value.

Remediation

Install update from vendor's website.

References

• https://github.com/amazon-ion/ion-java/security/advisories/GHSA-wj53-jv76-65mc
• https://github.com/amazon-ion/ion-java/security/advisories/GHSA-822f-6gg9-whr5