redhat/ion-java vulnerabilities

Latest redhat/ion-java CVEs

Newest publication first

1. CVE-2026-75935 Memory-amplification denial of service via declared-length preallocation in Amazon ion-java

   Published 2026-08-18

   High·CVSS 8.7

   Uncontrolled memory allocation in the binary Ion stream cursor in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted Ion binary document containing a declared-length field that causes excessive heap preallocation. To remediate this...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.