CVE-2024-21634: Amazon Ion Java Library DoS Vulnerability

CVE-2024-21634 Overview

CVE-2024-21634 is a denial-of-service vulnerability in Amazon Ion (ion-java), a Java implementation of the Ion data notation. Prior to version 1.10.5, applications that use ion-java to deserialize Ion text encoded data, or deserialize Ion text or binary encoded data into the IonValue model and then invoke certain IonValue methods on that in-memory representation, are vulnerable to a crafted payload attack. An attacker could craft malicious Ion data that, when loaded by the affected application and/or processed using the IonValue model, results in a StackOverflowError originating from the ion-java library.

Critical Impact

This vulnerability allows remote attackers to cause denial of service conditions in applications using vulnerable versions of the Amazon Ion Java library through crafted Ion data payloads that trigger stack exhaustion.

Affected Products

• Amazon Ion (ion-java) versions prior to 1.10.5
• Applications using ion-java for Ion text encoded data deserialization
• Applications using the IonValue model for Ion text or binary data processing

Discovery Timeline

• 2024-01-03 - CVE-2024-21634 published to NVD
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2024-21634

Vulnerability Analysis

This vulnerability falls under CWE-770 (Allocation of Resources Without Limits or Throttling). The flaw exists in how the ion-java library processes deeply nested or specially crafted Ion data structures. When the library attempts to deserialize malicious Ion content, it can enter into recursive processing without adequate depth checks or limits, ultimately exhausting the call stack.

The vulnerability is particularly concerning because it can be triggered remotely through network-accessible attack vectors. Applications that accept Ion-formatted data from untrusted sources—such as web APIs, message queues, or file uploads—are at risk. The attack requires no authentication or user interaction, making it straightforward for attackers to exploit.

Root Cause

The root cause is inadequate resource allocation controls during the deserialization process. When processing Ion data structures, the library does not properly limit recursion depth or resource consumption. This allows an attacker to craft Ion payloads with deeply nested structures that cause the Java Virtual Machine's call stack to overflow during parsing or when invoking certain IonValue methods on the deserialized in-memory representation.

Attack Vector

The attack vector is network-based, requiring an attacker to deliver malicious Ion-encoded data to an application using the vulnerable ion-java library. Attack scenarios include:

• Sending crafted Ion payloads to REST APIs that accept Ion data format
• Uploading malicious Ion files to applications that process uploaded content
• Injecting Ion data through message queues or streaming pipelines
• Man-in-the-middle modification of Ion data in transit

The attack exploits the recursive nature of Ion data structure parsing. By creating payloads with extreme nesting depth or circular-like structures, attackers can force the library into stack-exhausting recursive calls during deserialization or subsequent IonValue method invocations.

Detection Methods for CVE-2024-21634

Indicators of Compromise

• Unexpected StackOverflowError exceptions in application logs originating from ion-java library classes
• Application crashes or restarts coinciding with Ion data processing operations
• Abnormally large or deeply nested Ion payloads in request logs or data stores
• Increased memory pressure or CPU utilization during Ion deserialization

Detection Strategies

• Implement application logging to capture and alert on StackOverflowError exceptions specifically from Ion-related code paths
• Monitor application health metrics for unexpected crashes or restarts during data processing
• Deploy Web Application Firewall (WAF) rules to detect anomalously large or complex Ion payloads
• Use SentinelOne's runtime protection to detect and alert on process termination patterns consistent with stack exhaustion attacks

Monitoring Recommendations

• Enable detailed exception logging for Ion deserialization operations
• Set up alerting thresholds for StackOverflowError occurrences in production environments
• Monitor incoming request sizes and complexity metrics for endpoints accepting Ion data
• Implement application performance monitoring (APM) to track deserialization latency anomalies

How to Mitigate CVE-2024-21634

Immediate Actions Required

• Upgrade ion-java to version 1.10.5 or later immediately
• Audit all applications in your environment for ion-java dependencies using software composition analysis (SCA) tools
• Review dependency trees for transitive dependencies on vulnerable ion-java versions
• Prioritize patching for internet-facing applications that process Ion data from untrusted sources

Patch Information

The fix for this vulnerability is included in ion-java version 1.10.5. Amazon has released this patched version to address the stack overflow issue. Organizations should update their Maven or Gradle dependencies to specify version 1.10.5 or higher:

For Maven:

<dependency>
    <groupId>com.amazon.ion</groupId>
    <artifactId>ion-java</artifactId>
    <version>1.10.5</version>
</dependency>

For Gradle:

implementation 'com.amazon.ion:ion-java:1.10.5'

For additional details, refer to the GitHub Security Advisory GHSA-264p-99wq-f4j6.

Workarounds

• Do not load Ion data which originated from an untrusted source or that could have been tampered with
• Implement input validation to reject Ion payloads that exceed reasonable size or complexity thresholds
• Consider running Ion processing in isolated environments with resource limits (e.g., containerized workloads with memory and CPU constraints)
• Deploy network-level controls to filter potentially malicious Ion data before it reaches vulnerable applications

# Example: Check current ion-java version in Maven project
mvn dependency:tree -Dincludes=com.amazon.ion:ion-java

# Example: Force update to patched version
mvn versions:use-latest-versions -Dincludes=com.amazon.ion:ion-java