AWSAWS-2026-100
Incomplete fix for CVE-2026-75936 memory-amplification denial of service in Amazon...
UnratedCVE-2026-85786 · Published Sep 4, 2026 · updated Sep 9, 2026
Bulletin ID: 2026-100-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/04/2026 12:30 PM PDT Description: ion-java is a Java library that implements the Amazon Ion data format specification. We identified CVE-2026-85786, memory-amplification denial of service via highly compressed data expansion. ion-java 1.12.0 added a GZIP auto-decompression opt-out for CVE-2026-75936, but the implementation of the opt-out in 1.12.0 was insufficient to address the issue. Impacted versions: < 1.12.1 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
Affected versions
The source does not list versions here. See the source advisory for affected products and fixes.
Details and references
- Severity from
- no source yet
- Also known as
- CVE-2026-75936
More AWS advisories
All AWS| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Sep 4 | AWS log4j-cve-2021-44228-hotpatch: command injection High8.5Sep 4 | High8.5 | 1.3-9.amzn2 |
| Sep 4 | An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs...UnratedSep 4 | Unrated | No fix yet |
| Sep 4 | Unverified access point ownership in Amazon EFS CSI DriverUnratedSep 4 | Unrated | No fix yet |
| Sep 4 | Code injection in the CDK generator in Amazon awslabs.dynamodb-mcp-serverUnratedSep 4 | Unrated | No fix yet |
| Sep 3 | Creation of Temporary File in Directory with Insecure Permissions in AWS FPGA Development...UnratedSep 3 | Unrated | No fix yet |
| Sep 3 | OS command injection in the Amazon CodeCatalyst blueprints SDKUnratedSep 3 | Unrated | No fix yet |