Description

Improper handling of highly compressed data in Amazon ion-java before 1.12.1 might allow remote attackers to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression due to insufficient coverage of the GZIP auto-decompression opt-out introduced for CVE-2026-75936. To remediate this issue, users should upgrade to version 1.12.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-04T20:17:33.153Z",
  "pubdate": "2026-09-04T20:17:33.153Z",
  "executiveSummary": "The vulnerability in Amazon ion-java, prior to version 1.12.1, is a resource exhaustion flaw stemming from the improper handling of compressed data streams. Specifically, the library fails to adequately enforce GZIP auto-decompression restrictions when processing Ion documents.\nThis vulnerability is classified as a Denial of Service (DoS) risk, where a remote, unauthenticated attacker can supply a specially crafted, highly compressed Ion document. Upon ingestion, the library's decompression engine expands the payload into an arbitrarily large size, exceeding available memory allocations.\nThe root cause is an incomplete implementation of the opt-out mechanism for GZIP auto-decompression, originally intended as a fix for CVE-2026-75936. By bypassing these safeguards, an attacker can trigger an Out-of-Memory (OOM) condition, leading to service disruption or system instability.\nImpacts include critical availability loss for any application relying on ion-java to parse untrusted input. Exploitation does not require prior authentication or elevated privileges, making it a significant risk for internet-facing services that consume Ion data.",
  "technicalDetails": "The vulnerability resides within the Amazon ion-java processing pipeline, specifically concerning the logic responsible for handling GZIP-compressed data streams within Ion documents.\nRoot Cause: The library maintains an opt-out mechanism for automatic GZIP decompression, which was mandated as a security control in the remediation of CVE-2026-75936. The current issue identifies that this opt-out coverage is insufficient, allowing attackers to force the library to decompress malicious payloads that exhibit extremely high compression ratios—often referred to as a 'decompression bomb' or 'ZIP bomb' vector.\nExploitation Methodology: An attacker crafts a malicious Ion document using GZIP compression. The document is designed such that the ratio between the compressed payload and the decompressed output is extreme. When the ion-java parser encounters the stream, it attempts to inflate the data into memory buffers to facilitate processing. Because the necessary verification or boundary checks on the resulting decompressed size were not effectively applied due to the flawed opt-out implementation, the parser continues allocation until the Java Virtual Machine (JVM) heap is exhausted.\nAttack Flow: 1. Attacker identifies a network-exposed service that accepts Ion-formatted input. 2. Attacker transmits a crafted, highly compressed Ion document to the target endpoint. 3. The ion-java component initiates the reading process, triggering the GZIP auto-decompression routine. 4. The parser, failing to validate the potential expansion size against reasonable safety thresholds, rapidly consumes memory as the stream inflates. 5. The target application crashes or becomes non-responsive due to a fatal OutOfMemoryError, resulting in a successful denial-of-service attack.\nAffected Components: The issue affects the core data parsing and ingestion logic of ion-java versions prior to 1.12.1. The vulnerability is triggered remotely without requiring authentication or specific user privileges, as the parser is typically invoked upon receipt of incoming data streams.\nPost-Exploitation Impact: Beyond the immediate cessation of service, this vulnerability could potentially interfere with other processes sharing the same JVM, causing cascading failures in distributed architectures. There is no evidence of arbitrary code execution; however, the impact is strictly confined to the total compromise of service availability through resource exhaustion."
}