DoS via GZIP auto-decompress in Amazon ion-java <1.12.0
CVE-2026-75936 Published on August 18, 2026
Memory-amplification denial of service via GZIP decompression bomb in Amazon ion-java
Improper handling of highly compressed data in the GZIP auto-decompression handler in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression.
To remediate this issue, users should upgrade to version 1.12.0 and configure withGzipDecompressionEnabled(false) and/or set an explicit withMaximumBufferSize() when parsing untrusted input.
Vulnerability Analysis
CVE-2026-75936 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.
Weakness Type
What is a Data Amplification Vulnerability?
The software does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output. An example of data amplification is a "decompression bomb," a small ZIP file that can produce a large amount of data when it is decompressed.
CVE-2026-75936 has been classified to as a Data Amplification vulnerability or weakness.
Products Associated with CVE-2026-75936
stack.watch emails you whenever new vulnerabilities are published in Amazonion Amazon Ion Java or Amazon Aws. Just hit a watch button to start following.
Affected Versions
Amazon Ion Java:- Before 1.12.0 is affected.