CVE-2026-75935 — Memory-amplification denial of service via declared-length preallocation in Amazon ion-java
Uncontrolled memory allocation in the binary Ion stream cursor in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted Ion binary d…
Published: 2026-08-18 · CVSS: 8.7 · CVSS 4.0
Uncontrolled memory allocation in the binary Ion stream cursor in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted Ion binary document containing a declared-length field that causes excessive heap preallocation. To remediate this issue, users should upgrade to version 1.12.0.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7