The Amazon IonDotnet library is susceptible to a denial of service vulnerability that allows unauthenticated attackers to trigger an infinite loop using malicious input.

This is an infinite loop flaw (CWE-1286) triggered by improper validation of input syntax. The vulnerability is exploitable by an unauthenticated attacker over the network.

Successful exploitation of this vulnerability results in a denial of service condition, rendering the affected application unresponsive. Given the CVSS score of 7.5, this high severity issue poses a risk to service availability, particularly for systems processing untrusted Ion text data.

Immediate Action: Update the Amazon IonDotnet library to version 1.3.2 or later. Note that the library has been deprecated as of August 20, 2025, and will receive no further security updates.

Proactive Monitoring: Monitor application logs and CPU utilization metrics for spikes or processes entering an unresponsive state when handling Ion text inputs.

Compensating Controls: Implement strict input validation or sanitization layers to inspect incoming text payloads for malformed data before processing by the IonDotnet library.

Public Exploit Available: Unknown

Organizations currently utilizing the Amazon IonDotnet library must prioritize upgrading to version 1.3.2 immediately. Because this project is officially deprecated, users should also plan for a migration to a supported alternative to ensure long-term security and maintainability of their application infrastructure.