Amazon ion-java vulnerabilities

Latest Amazon ion-java CVEs

Newest publication first

1. CVE-2026-85786 Incomplete fix for CVE-2026-75936 memory-amplification denial of service in Amazon ion-java

   Published 2026-09-04

   High·CVSS 8.7 EPSS 0.58%

   Improper handling of highly compressed data in Amazon ion-java before 1.12.1 might allow remote attackers to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression due to insufficient coverage of the GZIP auto-...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.