CVE-2026-85786 - Incomplete fix for CVE-2026-75936 memory-amplification denial of service in Amazon ion-java
Bulletin ID: 2026-100-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 09/04/2026 12:15 PM PDT
Description:
ion-java is a Java library that implements the Amazon Ion data format specification. We identified CVE-2026-85786, memory-amplification denial of service via highly compressed data expansion. ion-java 1.12.0 added a GZIP auto-decompression opt-out for CVE-2026-75936, but the implementation of the opt-out in 1.12.0 was insufficient to address the issue.
Impacted versions: < 1.12.1
Resolution:
This issue has been addressed in ion-java version 1.12.1. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds:
None.
References:
Please email aws-security@amazon.com with any security questions or concerns.