Ion Java
Monthly
Decompression bomb handling in Amazon ion-java before version 1.12.1 allows remote unauthenticated attackers to cause denial of service by submitting crafted GZIP-compressed Ion documents that expand to arbitrarily large sizes during automatic decompression. The vulnerability is a bypass of the incomplete fix for CVE-2026-75936, which introduced a GZIP auto-decompression opt-out that did not cover all decompression paths in the library. No public exploit has been identified at time of analysis, but the straightforward nature of decompression bomb construction makes the attack practically accessible to any attacker who can submit Ion data to a vulnerable application.
Decompression bomb handling in Amazon ion-java before version 1.12.1 allows remote unauthenticated attackers to cause denial of service by submitting crafted GZIP-compressed Ion documents that expand to arbitrarily large sizes during automatic decompression. The vulnerability is a bypass of the incomplete fix for CVE-2026-75936, which introduced a GZIP auto-decompression opt-out that did not cover all decompression paths in the library. No public exploit has been identified at time of analysis, but the straightforward nature of decompression bomb construction makes the attack practically accessible to any attacker who can submit Ion data to a vulnerable application.