Advisoriesby IbisAWSAWS-2026-100
Incomplete fix for CVE-2026-75936 memory-amplification denial of service in Amazon...
No fix yet
Bulletin ID: 2026-100-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/04/2026 12:30 PM PDT Description: ion-java is a Java library that implements the Amazon Ion data format specification. We identified CVE-2026-85786, memory-amplification denial of service via highly compressed data expansion. ion-java 1.12.0 added a GZIP auto-decompression opt-out for CVE-2026-75936, but the implementation of the opt-out in 1.12.0 was insufficient to address the issue. Impacted versions: < 1.12.1 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
Affected versions
The source does not list versions here. See the source advisory for affected products and fixes.
Changes since it was listed
Severity: Unrated to High
Details and references
- Severity from
- NVD
- Also known as
- CVE-2026-75936
More AWS advisories
All AWS
AWS log4j-cve-2021-44228-hotpatch: command injectionCVE-2026-85656fixed in 1.3-9.amzn2Unverified access point ownership in Amazon EFS CSI DriverCVE-2026-85781no fix yetCode injection in the CDK generator in Amazon awslabs.dynamodb-mcp-serverCVE-2026-85654no fix yetCreation of Temporary File in Directory with Insecure Permissions in AWS FPGA Development...CVE-2026-85028no fix yetOS command injection in the Amazon CodeCatalyst blueprints SDKCVE-2026-85012no fix yetUncontrolled recursion in the Ion reader in Amazon Ion-C before 1.1.6CVE-2026-84851no fix yet