Vulnerability · Published Apr 21, 2025 · Assigned by AMZN

CVE-2025-3857Infinite loop condition in Amazon.IonDotnet

High 7.5

In plain English

A high-severity infinite loop in Amazon Ion Dotnet from Amazon. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.6%top 50.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

When reading binary Ion data through Amazon.IonDotnet using the RawBinaryReader class, Amazon.IonDotnet does not check the number of bytes read from the underlying stream while deserializing the binary format. If the Ion data is malformed or truncated, this triggers an infinite loop condition that could potentially result in a denial of service. Users should upgrade to Amazon.IonDotnet version 1.3.1 and ensure any forked or derivative code is patched to incorporate the new fixes.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
NuGet	amazon.iondotnet	1.3.1	GHSA-gm2p-wf5c-w3pj

Affected products (as reported)

Vendor	Product	Versions
Amazon	Amazon Ion Dotnet	0 – before 1.3.1

Weakness: CWE-835, CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://aws.amazon.com/security/security-bulletins/AWS-2025-009/ vendor-advisory
https://github.com/amazon-ion/ion-dotnet/security/advisories/GHSA-gm2p-wf5c-w3pj third-party-advisory
https://github.com/amazon-ion/ion-dotnet/releases/tag/v1.3.1 patch