In plain language
What this advisory means
Amazon's ion-java library had a vulnerability where specially compressed data could cause the software to use excessive memory and crash. An initial attempt to fix this vulnerability with version 1.12.0 did not fully prevent the problem. Amazon has now released version 1.12.1 which fully addresses this issue. Users should upgrade to this version to protect their systems.
Technical explanation
How the issue affects the environment
The ion-java library, which implements the Amazon Ion data format in Java, was vulnerable to a memory-amplification denial of service attack identified as CVE-2026-85786. This occurs through processing highly compressed data that expands in memory, consuming excessive resources and causing denial of service. An earlier vulnerability, CVE-2026-75936, was partially mitigated in ion-java 1.12.0 by adding an opt-out for GZIP auto-decompression. However, this mitigation was insufficient, leaving the memory-amplification issue exploitable. The incomplete fix allowed attackers to exploit the decompression mechanism leading to high memory use. The issue has been fully addressed in ion-java version 1.12.1, which corrects the decompression handling to prevent excessive memory consumption and consequent denial of service.
Operational impact
Why teams should care
If exploited, this vulnerability could cause applications using ion-java to consume excessive memory and crash, disrupting service availability. This impacts organizations relying on ion-java for data processing within Amazon Web Services or other environments, potentially leading to downtime, degraded user experience, and operational costs related to service interruptions or recovery. Because there's no workaround, timely upgrading is essential to maintain service stability and security.
Immediate action
Upgrade ion-java to version 1.12.1 or later. Ensure any forked or derivative code is also patched to include the fixes in 1.12.1 to fully resolve the memory-amplification denial of service vulnerability.
Affected and fixed releases
Temporary risk reduction
AWS does not specify any workaround for this issue. Users should upgrade to the fixed version.
Evidence and validation checklist
- AWS Security Bulletin ID 2026-100-AWS dated 09/04/2026
- Description of CVE-2026-85786 memory-amplification DoS via data expansion
- Ineffective initial fix in ion-java 1.12.0 with GZIP opt-out implementation
- Announcement of full fix in ion-java 1.12.1
- Recommendation to upgrade to latest version and patch forks
Authoritative reference
AWS Security Bulletins
QCS detected and normalized this record from the official source. Vendor guidance remains authoritative.