Vulnerability · Published Sep 4, 2026 · Assigned by AMZN

CVE-2026-85786Incomplete fix for CVE-2026-75936 memory-amplification denial of service in Amazon ion-java

High 7.5

In plain English

A high-severity security flaw in ion-java from Amazon. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.6%top 52.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Improper handling of highly compressed data in Amazon ion-java before 1.12.1 might allow remote attackers to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression due to insufficient coverage of the GZIP auto-decompression opt-out introduced for CVE-2026-75936. To remediate this issue, users should upgrade to version 1.12.1.

Affected products (as reported)

Vendor	Product	Versions
Amazon	ion-java	0 – before 1.12.1

Weakness: CWE-409 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/amazon-ion/ion-java/releases/tag/v1.12.1 patch, release-notes
https://aws.amazon.com/security/security-bulletins/2026-100-aws/ vendor-advisory