Bulletin ID: 2026-083-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 08/18/2026 12:30 PM PDT

Description:

ion-java is a Java library that implements the Amazon Ion data format specification. We identified CVE-2026-75935, memory-amplification denial of service via declared-length preallocation, and CVE-2026-75936, memory-amplification denial of service via highly compressed data expansion.

Affected versions: < 1.12.0

Resolution:

These issues have been addressed in ion-java version 1.12.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. Users should configure a limited maximum buffer size via IonBufferConfiguration.withMaximumBufferSize to cap growth and should manually disable automatic GZIP decompression via IonReaderBuilder.withGzipDecompressionEnabled(false) if handling untrusted input.

Workarounds:

Prior to version 1.12.0, there is no workaround effective for all encodings accepted by ion-java parsers ([text, binary] x [GZIP, uncompressed]), but configuring the parser with a limited maximum buffer size via IonBufferConfiguration.withMaximumBufferSize is effective for all combinations except GZIP-encoded text Ion.

References:

• CVE-2026-75935
• CVE-2026-75936
• GHSA-822f-6gg9-whr5
• GHSA-wj53-jv76-65mc

Please email aws-security@amazon.com with any security questions or concerns.