CVE-2026-75935: Amazon ion-java DoS Vulnerability

CVE-2026-75935 Overview

CVE-2026-75935 is an uncontrolled memory allocation vulnerability in Amazon ion-java versions prior to 1.12.0. The flaw resides in the binary Ion stream cursor, which allocates heap memory based on a declared length field inside untrusted Ion binary documents. Remote attackers can send a crafted Ion binary document containing an oversized declared-length field to trigger excessive heap preallocation. The result is a denial-of-service condition against any Java application that parses attacker-controlled Ion data. The issue is tracked under CWE-789: Memory Allocation with Excessive Size Value and was disclosed through GitHub Security Advisory GHSA-822f-6gg9-whr5.

Critical Impact
An unauthenticated remote attacker can exhaust JVM heap memory by submitting a single crafted Ion binary document, crashing services that deserialize Ion data.

Affected Products

Amazon ion-java versions prior to 1.12.0
Java applications and AWS services embedding vulnerable ion-java releases
Downstream libraries that transitively depend on ion-java for Ion binary parsing

Discovery Timeline

2026-08-18 - CVE-2026-75935 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-75935

Vulnerability Analysis

Amazon Ion is a richly typed, self-describing data serialization format used across AWS services and open-source Java projects. The ion-java library exposes a binary stream cursor that reads type descriptors and their declared value lengths from the input stream. When the cursor encounters a declared-length field, it preallocates a heap buffer sized according to that value before validating whether the stream contains enough bytes to fill it.

An attacker who controls Ion input can encode a very large declared length in the type descriptor while providing only a few bytes of payload. The cursor honors the declared length and requests a correspondingly large allocation from the JVM. Repeated or single large requests exhaust the heap and force an OutOfMemoryError, terminating the parsing thread or the entire process.

The attack requires no authentication, no user interaction, and no prior access. Any endpoint that accepts and parses Ion binary data from untrusted sources is exposed.

Root Cause

The root cause is a missing sanity check between the declared length value in the Ion binary type descriptor and the actual number of bytes remaining in the stream. The cursor trusts the attacker-supplied length and allocates memory eagerly instead of streaming or bounding allocations against remaining input size. This pattern maps directly to CWE-789.

Attack Vector

Exploitation occurs over the network wherever ion-java deserializes attacker-influenced Ion binary payloads. Common exposure points include HTTP APIs that accept application/x-amz-ion-1.0, message queues carrying Ion-encoded events, and file ingestion pipelines. The attacker crafts an Ion binary document whose type descriptor advertises a length in the hundreds of megabytes or gigabytes and submits it to the target. Refer to the GitHub Security Advisory GHSA-822f-6gg9-whr5 and the AWS Security Bulletin 2026-083 for authoritative technical detail.

Detection Methods for CVE-2026-75935

Indicators of Compromise

Repeated java.lang.OutOfMemoryError: Java heap space events in application logs originating from com.amazon.ion stack frames.
Abrupt JVM garbage-collection storms or process restarts correlated with inbound Ion binary traffic.
Inbound requests carrying the Ion binary version marker 0xE0 0x01 0x00 0xEA followed by anomalously large declared-length fields.

Detection Strategies

Inspect HTTP request bodies and message payloads for the Ion binary magic header and flag documents whose declared field lengths exceed a policy threshold.
Enable JVM flight recording or heap dump on OutOfMemoryError and search stack traces for IonCursorBinary or IonReaderBinary frames.
Build a dependency inventory query against software bill of materials (SBOM) data to identify services shipping ion-java below version 1.12.0.

Monitoring Recommendations

Alert on sustained heap utilization above 85% on services known to parse Ion, and correlate against request source IPs.
Track process exit codes and container OOM-kill events for Java workloads that ingest Ion data.
Route web application firewall (WAF) and API gateway logs into a centralized data lake for long-window correlation of malformed Ion submissions.

How to Mitigate CVE-2026-75935

Immediate Actions Required

Upgrade ion-java to version 1.12.0 or later across all direct and transitive dependencies.
Rebuild and redeploy Java services that embed ion-java, including container images and serverless function packages.
Review AWS SDK and internal library versions against the AWS Security Bulletin 2026-083 and update accordingly.

Patch Information

The fix is included in ion-java1.12.0, published in the GitHub Release v1.12.0. The patched cursor validates declared-length fields against remaining stream bytes before allocating heap buffers, preventing attacker-controlled preallocation.

Workarounds

Enforce strict request size limits at the API gateway or reverse proxy for endpoints that accept Ion binary payloads.
Constrain JVM heap size with -Xmx and isolate Ion parsing into dedicated worker processes so an OOM does not take down the primary service.
Reject Ion binary inputs from untrusted sources until dependencies are upgraded, accepting only Ion text or an alternative format validated against a schema.

bash

# Verify ion-java version in a Maven project
mvn dependency:tree -Dincludes=com.amazon.ion:ion-java

# Upgrade to the patched release in pom.xml
# <dependency>
#   <groupId>com.amazon.ion</groupId>
#   <artifactId>ion-java</artifactId>
#   <version>1.12.0</version>
# </dependency>

# Verify ion-java version in a Gradle project
./gradlew dependencyInsight --dependency ion-java