Amazon ion-java CVE-2026-75935

The vulnerable code path is activated only when an application parses Ion binary-format data (not Ion text format) using the binary stream cursor in ion-java versions 1.9.0 through 1.11.x. No authentication, no privileged access, and no non-default configuration are required - the CVSS 4.0 vector (PR:N, AC:L, AT:N) confirms this. Any application that accepts Ion binary documents from external or untrusted sources over a network is directly exposed. Exploitation is limited to denial of service through heap exhaustion; there is no code execution, privilege escalation, or data disclosure vector. Services that exclusively use Ion text format, that parse only internally generated Ion data, or that authenticate all Ion-submitting callers before invoking the parser are not exposed to unauthenticated exploitation.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) accurately characterizes the risk profile: the attack is network-reachable, requires no authentication, no special configuration, and no user interaction, making it highly automatable against any exposed endpoint that processes Ion binary input. Impact is confined entirely to availability (VA:H), with no confidentiality or integrity consequences, which appropriately bounds the ceiling of harm. No EPSS data was supplied, and the vulnerability does not appear in the CISA KEV catalog, suggesting exploitation has not been observed at scale. However, the very low exploitation barrier - a single crafted packet against a default-configured library - means any public-facing service ingesting binary Ion data from untrusted sources should treat this as a near-term patch priority. Risk is substantially lower for services that parse only Ion text format or restrict Ion input to internal authenticated callers.

An unauthenticated remote attacker identifies a public-facing service that accepts Ion binary data - for example, an API endpoint or data ingestion pipeline built on an affected ion-java version. The attacker constructs a minimal Ion binary document in which a declared-length field is set to a value near the maximum integer size, then submits it over HTTP or another transport. The ion-java binary stream cursor attempts to preallocate a correspondingly large heap buffer before reading any payload bytes, triggering a JVM OutOfMemoryError that crashes or severely degrades the target service. No public proof-of-concept has been identified at the time of analysis.