A high-severity denial of service vulnerability in Amazon ion-java, identified as CVE-2026-85786, allows remote attackers to crash systems by sending specially crafted compressed Ion documents.

The library improperly handles highly compressed data, leading to a data amplification scenario (CWE-409). Unauthenticated attackers can exploit this by submitting a crafted document that expands to an arbitrarily large size during decompression, consuming excessive system resources.

Successful exploitation of this vulnerability results in a denial of service, which can cause significant operational disruption and service outages for applications relying on the ion-java library. Given the CVSS score of 7.5, this high-severity flaw poses a direct risk to availability, potentially impacting business continuity and requiring immediate attention from engineering and security teams to prevent service degradation.

Immediate Action: Upgrade the Amazon ion-java library to version 1.12.1 or later to implement the corrected GZIP auto-decompression opt-out logic.

Proactive Monitoring: Monitor application server logs and system metrics for sudden spikes in memory usage or crash events associated with Ion document processing.

Compensating Controls: Implement strict input validation or size limits on incoming documents at the application or network boundary to reject excessively large or malformed compressed payloads before they reach the decompression routine.

Public Exploit Available: Unknown

The vulnerability represents a clear risk to service availability through resource exhaustion. Organizations should prioritize patching this dependency in all production environments to eliminate the risk of denial of service attacks. If an immediate update is not feasible, ensure that rigorous input size validation is in place to mitigate the impact of malicious decompression requests.