CVE-2026-75936: Amazon Ion Java, отказ на услуга

Описание

Оригинално описание

Improper handling of highly compressed data in the GZIP auto-decompression handler in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression. To remediate this issue, users should upgrade to version 1.12.0 and configure withGzipDecompressionEnabled(false) and/or set an explicit withMaximumBufferSize() when parsing untrusted input.

Засегнати продукти

• Amazon Ion Amazon Ion Java: преди 1.12.0

Вид слабост

• CWE-409 Неправилна обработка на силно компресирани данни (усилване на данни)

История

Други уязвимости в Amazon Ion Amazon Ion Java

• 8.7CVE-2026-75935

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-75936
• https://nvd.nist.gov/vuln/detail/CVE-2026-75936
• https://github.com/amazon-ion/ion-java/releases/tag/v1.12.0
• https://github.com/amazon-ion/ion-java/security/advisories/GHSA-wj53-jv76-65mc
• https://aws.amazon.com/security/security-bulletins/2026-083-aws/