Amazon ion-java < 1.12.1: GZIP Decompression DoS via Unchecked Compression
CVE-2026-85786 Published on September 4, 2026
Incomplete fix for CVE-2026-75936 memory-amplification denial of service in Amazon ion-java
Improper handling of highly compressed data in Amazon ion-java before 1.12.1 might allow remote attackers to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression due to insufficient coverage of the GZIP auto-decompression opt-out introduced for CVE-2026-75936.
To remediate this issue, users should upgrade to version 1.12.1.
Vulnerability Analysis
CVE-2026-85786 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is a Data Amplification Vulnerability?
The software does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output. An example of data amplification is a "decompression bomb," a small ZIP file that can produce a large amount of data when it is decompressed.
CVE-2026-85786 has been classified to as a Data Amplification vulnerability or weakness.
Products Associated with CVE-2026-85786
stack.watch emails you whenever new vulnerabilities are published in Amazon Ion Java or Amazon Aws. Just hit a watch button to start following.
Affected Versions
Amazon ion-java:- Before 1.12.1 is affected.