Bug 2518208 (CVE-2026-75935) - CVE-2026-75935 software.amazon.ion/ion-java: Amazon ion-java: Denial of service via uncontrolled memory allocation
Summary: CVE-2026-75935 software.amazon.ion/ion-java: Amazon ion-java: Denial of servi...
Keywords:
Status: NEW
Alias: CVE-2026-75935
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-18 19:58 UTC by OSIDB Bzimport
Modified: 2026-09-23 14:40 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-08-18 19:58:16 UTC 
Uncontrolled memory allocation in the binary Ion stream cursor in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted Ion binary document containing a declared-length field that causes excessive heap preallocation.



To remediate this issue, users should upgrade to version 1.12.0.
Note You need to log in before you can comment on or make changes to this bug.