Denial of Service issue in Amazon.IonDotnet
Priority MEDIUM 44CWE-1286Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.
Summary
An infinite loop issue in Amazon.IonDotnet library versions <v1.3.2 may allow a threat actor to cause a denial of service through a specially crafted text input. To mitigate this issue, users should upgrade to version v1.3.2. As of August 20, 2025, this library has been deprecated and will not receive further updates.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00432 37th percentileScored 2026-11-07
Fix Fixed Amazon.IonDotnet (Amazon): 1.3.2Amazon.IonDotnet (NuGet): 1.3.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| AWS | Amazon.IonDotnet | before 1.3.2 | 1.3.2 | Patch available | CNA |
| — | Amazon.IonDotnet (NuGet) | before 1.3.2 | 1.3.2 | Patch available | GHSA-q5r6-9qwq-g2wj |
- Amazon.IonDotnet VendorAWS Affected before 1.3.2 Fixed in 1.3.2 Patch available CNA
- Amazon.IonDotnet (NuGet) Vendor— Affected before 1.3.2 Fixed in 1.3.2 Patch available GHSA-q5r6-9qwq-g2wj
Remediation
- Fix · CNA Amazon.IonDotnet (Amazon) Fixed in 1.3.2
- Fix · GHSA-q5r6-9qwq-g2wj Amazon.IonDotnet (NuGet) Fixed in 1.3.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-11573
- 2026-10-03 Alias added: GHSA-q5r6-9qwq-g2wj
References
Advisory 3
More AWS vulnerabilities
- TI-2026-23989 crypto: algif_aead - Revert to operating out-of-place KEVCVSS 3.1HIGH 7.8
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2024-18648 Amazon AWS Amplify CLI before 12.10.1 incorrectly configures the role trust policy of IAM… CVSS 3.1CRITICAL 9.8
- TI-2024-05929 Openssh: regresshion - race condition in ssh allows rce/dos CVSS 3.1HIGH 8.1
- TI-2025-03847 Input validation issue in AWS Amplify Studio UI component properties CVSS 4.0CRITICAL 9.0
- TI-2026-11603 HTTP/2 Stream Parser Confusion Body-Inspection Bypass in Amazon CloudFront with AWS WAF CVSS 4.0HIGH 7.9
Sources
- CVE-2025-11573 · CVE Program
- CVE-2025-11573 · NVD
- FIRST EPSS
- GHSA-q5r6-9qwq-g2wj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences