Improper handling of highly compressed data in the GZIP auto-decompression handler in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted compressed Ion document that expand…
CVSS 4.0HIGH 8.7·Network·No auth·No interaction·EPSS 0.00609·Published 2026-08-18·Fixed in 1.12.0CWE-409
Uncontrolled memory allocation in the binary Ion stream cursor in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted Ion binary document containing a declared-length field…
