CVE-2026-75935

Amazon ion-java before 1.12.0 has uncontrolled heap preallocation in its binary Ion stream cursor. A crafted binary Ion document with a malicious declared-length field triggers excessive memory allocation, enabling remote denial of service. CVSS 7.5 HIGH; no in-the-wild exploitation reported. Upg...

PT-2026-77296

Uncontrolled memory allocation in the binary Ion stream cursor in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted Ion binary document containing a declared-length field that causes excessive heap preallocation. To remediate this issue, users shou...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop via the RawBinaryReader class. This is due to a missing check of the number of bytes read from the underlying stream while deserializing the binary format when reading binary Ion data. Remediation Upgrade Amazon.IonDotnet ...

CVE-2025-3857

Summary: A vulnerability in Amazon.IonDotnet’s RawBinaryReader can cause an infinite loop when reading binary Ion data if the input is malformed or truncated, due to not checking the number of bytes read from the underlying stream. This could lead to denial of service. Affected versions: Amazon.I...