CVE-2026-75936: Amazon Ion Java

High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days.

Improper handling of highly compressed data in the GZIP auto-decompression handler in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression. To remediate this issue, users should upgrade to version 1.12.0 and configure withGzipDecompressionEnabled(false) and/or set an explicit withMaximumBufferSize() when parsing untrusted input.

Affected products

• Amazon Ion Amazon Ion Java: before 1.12.0 (fixed in 1.12.0)

Published 2026-08-18. Last modified 2026-08-20.