CVE-2026-75935 and CVE-2026-75936 - Issue with Amazon ion-java - Memory-amplification denial of service
Ion ยท 2026-10-21
Actions
Technical Details
| Affected Versions | < 1.12.0 |
|---|---|
| Regions | all |
| CVE IDs | CVE-2026-75935, CVE-2026-75936 |
| Migration Required | Yes |
| Cost Impact | Neutral |
| IaC Impact | High |
What This Means
For DevOps Teams
Update ion-java to version 1.12.1 or later to address the memory-amplification denial of service vulnerabilities, configure a limited maximum buffer size, and disable automatic GZIP decompression for untrusted input to enhance security posture.
For Platform Teams
Deploy the updated ion-java version 1.12.1 across all relevant services to mitigate security risks and maintain system integrity, ensuring all parser configurations are aligned with the new security measures.
For Executives
Implement the upgrade to ion-java 1.12.1 to mitigate the identified memory-amplification denial of service vulnerabilities (CVE-2026-75935 and CVE-2026-75936) and ensure system resilience against potential attacks.
Source
Related Ion Updates
- CVE-2026-84851- Uncontrolled recursion in the Ion reader in Amazon Ion-C before 1.1.6 (2026-10-21)
- CVE-2026-85786 - Incomplete fix for CVE-2026-75936 memory-amplification denial of service in Amazon ion-java (2026-10-21)
- Amazon SageMaker AI now supports serverless model customization for NVIDIA Nemotron 3.5 Lightning (2026-09-16)