CVE-2026-75936

Executive Summary

CVE-2026-75936 is a denial-of-service (DoS) vulnerability in Amazon's ion-java library, affecting versions prior to 1.12.0. The vulnerability exists in the GZIP auto-decompression handler and allows a remote, unauthenticated attacker to cause resource exhaustion by submitting a crafted Ion document containing highly compressed data that expands to an arbitrarily large size when decompressed. Successful exploitation results in a high-availability impact (CVSS 3.1 score 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), potentially exhausting memory or CPU resources on the target system.

Technical Analysis

The vulnerability is classified under CWE-409 (Improper Handling of Highly Compressed Data), commonly referred to as a "zip bomb" or "decompression bomb" attack. The affected component is the GZIP auto-decompression handler within the Amazon ion-java library, which is a Java implementation of the Amazon Ion data serialization format.

Amazon Ion is a hierarchical, self-describing data format that supports both text and binary representations, and it can optionally use compression (including GZIP) to reduce payload size during transmission. When ion-java receives an incoming Ion document and auto-decompression is enabled (which is the default behavior), the library automatically detects and decompresses the GZIP-compressed payload without requiring explicit user intervention.

The vulnerability mechanism is rooted in the absence of adequate decompression size limits prior to version 1.12.0. A malicious actor can craft an Ion binary document that is small on disk or in transit (due to GZIP compression) but which, when decompressed, expands to a dramatically larger size. Because the library does not enforce a maximum decompressed buffer size by default, the decompression process can allocate memory proportional to the expanded size. An attacker can chain multiple compression layers or use highly repetitive data to achieve extreme compression ratios (e.g., 1000:1 or higher). This can lead to rapid memory exhaustion (OutOfMemoryError in Java), excessive CPU consumption during the decompression operation, or both, resulting in a denial-of-service condition for the application using the library.

The NVD description notes that remediation requires two actions: upgrading to version 1.12.0, where the issue is addressed, and configuring the library with withGzipDecompressionEnabled(false) and/or setting an explicit withMaximumBufferSize() when parsing untrusted input. This indicates that the vendor's fix involves both a default-behavior change (likely enabling a default buffer limit) and providing explicit configuration options for security-conscious deployments to disable GZIP decompression entirely or constrain buffer allocation.

No specific code-level details about the vulnerable code paths (e.g., method names, internal classes) are provided in the NVD description beyond the withGzipDecompressionEnabled and withMaximumBufferSize configuration methods mentioned in the remediation guidance. Without additional vendor advisory details, deeper code-level analysis is not possible.

The attack surface is any application that uses ion-java to parse Ion documents from untrusted or semi-trusted sources, including network-facing services that accept Ion payloads via HTTP, message queues (e.g., Amazon Kinesis, AWS services that use Ion), or file ingestion pipelines. Because the CVSS vector indicates AV:N and PR:N (network-accessible, no privileges required), the vulnerable service is remotely reachable without authentication.

Exploitation Scenarios

Step 1: Reconnaissance and Target Identification

An attacker first identifies services that parse Amazon Ion documents using the ion-java library (version < 1.12.0). Typical reconnaissance involves:

• Scanning for public-facing API endpoints or services that advertise support for the Ion data format.
• Shodan or similar internet-wide scanning for services that respond to Ion content-type headers (e.g., application/x-amz-ion).
• Identifying previously exposed services in developer documentation, API references, or Maven dependency listings (ion-java is a widely used library in AWS Java SDK and related tools).
• Determining if GZIP auto-decompression is enabled — this is the default behavior, so most deployments are likely vulnerable without explicit hardening.

Step 2: Triggering the Vulnerability Class

The attacker crafts a malicious Ion document containing a GZIP-compressed section. The compressed payload is engineered to achieve an extreme decompression ratio. Techniques include:

• Embedding highly repetitive data (e.g., a large sequence of identical bytes) that compresses extremely well with GZIP/DEFLATE.
• Nesting compression layers — although the description points to the GZIP handler specifically, layered compression can amplify the effect.
• Constructing the Ion binary format to include the compressed blob as a valid Ion value (e.g., as a blob field within the metadata of the datagram).

The attacker submits this crafted document to the target service through any channel the service accepts (HTTP request body, WebSocket frame, message queue, file upload). Since auto-decompression is enabled by default and no buffer limit is enforced in versions before 1.12.0, the library begins decompression automatically upon parsing the Ion container metadata.

Step 3: Execution of the Attack

Because the decompression handler has no maximum buffer size constraint (or an insufficiently large default), the library proceeds to allocate memory as it decompresses. The malicious payload — perhaps only a few kilobytes or megabytes on the wire — expands to gigabytes or terabytes of data. The Java Virtual Machine (JVM) running the affected service will:

• Consume large amounts of heap memory, eventually throwing OutOfMemoryError.
• Spend significant CPU cycles on inflate/decompression operations.
• Potentially cause the application to become unresponsive, hang, or crash entirely.

A single request may be sufficient to trigger the condition. An attacker can also send multiple concurrent malicious documents to exhaust the JVM heap more rapidly.

Step 4: Post-Exploitation Impact

The impact is a denial-of-service condition:

• The affected service becomes unavailable to legitimate users.
• The JVM may crash, requiring a restart and causing extended downtime.
• In multi-tenant environments, resource exhaustion could impact co-located services/processes on the same host (though JVM isolation limits this to some extent).
• Monitoring and alerting may fire, potentially causing further operational disruption.
• If the service is part of a larger orchestrated system (e.g., container orchestration), the OutOfMemoryError may trigger container restarts in a crash loop, compounding the availability impact.

No privilege escalation, data exfiltration, or integrity compromise is possible — the vulnerability is purely a resource-exhaustion DoS. No public PoC is available; the attack chain described above is inferred from the vulnerability class (CWE-409) and the NVD description.

Impact Assessment

CVSS Context: The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating:

• Attack Vector: Network (AV:N) — remotely exploitable.
• Attack Complexity: Low (AC:L) — no special conditions or race windows are required.
• Privileges Required: None (PR:N) — no authentication is needed.
• User Interaction: None (UI:N) — no victim action required.
• Scope: Unchanged (S:U) — the impact is confined to the vulnerable component's security authority (the application process).
• Confidentiality/Integrity Impact: None — no data leakage or modification.
• Availability Impact: High (A:H) — total loss of availability, consistent with application crash or hang.

Business Impact:

• Availability: Critical — services relying on ion-java for input parsing can be taken offline with a single unauthenticated request.
• Operational: High — incident response, service restarts, and forensic analysis will be required.
• Reputational: Moderate — DoS of public-facing services undermines trust and can lead to SLA breaches in enterprise contexts.
• Financial: Potentially significant if the affected service is revenue-generating or tied to production systems.

Affected Systems: Any application using Amazon ion-java versions prior to 1.12.0 that parses Ion documents from network-facing or semi-trusted inputs (e.g., HTTP APIs, AWS SDK components, data ingestion pipelines).

Blast Radius: Limited to the availability of individual applications using the library. Since the library is widely consumed via dependency trees (e.g., AWS Java SDK v2 historically used ion-java), the number of potentially affected applications is large, though not all will expose untrusted input parsing.

Exploitation in the Wild: No evidence of active exploitation or known threat actor campaigns has been identified. CISA KEV does not list this CVE. The vulnerability's ease of exploitation (low complexity, no privileges, network attack vector) suggests that weaponization is straightforward once a public PoC surfaces.

Detection Guidance

Sigma Rule

Sigma rule to detect application logs indicating decompression-bomb-related errors, including OutOfMemoryError during Ion parsing (adjust service field to match your environment).

title: Amazon ion-java Decompression Bomb DoS Attempt
id: 2d4a8f1c-7b3e-4e5a-9c1d-6f8a2b4c3d5e
status: experimental
description: Detects error conditions associated with Amazon ion-java decompression bomb exploitation (CVE-2026-75936), including GZIP decompression failures and OutOfMemoryError during Ion parsing.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-75936
tags:
    - attack.t1499
    - cve.2026-75936
logsource:
    category: application
    product: java
detection:
    selection_oom:
        message|contains:
            - 'java.lang.OutOfMemoryError'
            - 'GC overhead limit exceeded'
            - 'unable to create new native thread'
    selection_ion:
        message|contains:
            - 'ion-java'
            - 'IonSystem'
            - 'Amazon Ion'
            - 'GZIP decompression'
            - 'Inflater'
            - 'decompression'
        message|contains|all:
            - 'error'
            - 'exception'
    filter_known_good:
        message|contains:
            - 'handled gracefully'
            - 'byte limit exceeded'
    condition: (selection_oom or selection_ion) and not filter_known_good
    timeframe: 5m
level: high
falsepositives:
    - Legitimate large Ion documents causing OutOfMemoryError
    - Application startup errors unrelated to CVE-2026-75936
    - Legitimate use of custom decompression handlers
fields:
    - host
    - source_address
    - process
    - message

YARA Rule

YARA rule to detect Ion binary documents with GZIP-compressed sections that exhibit high compression ratios (heuristic heuristic based on small compressed size with potential for large expansion — actual detection requires scanning for Ion/GZIP signatures in payloads likely to be exploited).

rule amazon_ion_gzip_decompression_bomb {
    meta:
        author = "valtersit.com Threat Intel"
        description = "Detects GZIP-compressed Amazon Ion documents indicative of CVE-2026-75936 decompression bomb attacks"
        cve = "CVE-2026-75936"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-75936"
        date = "2026-01-01"
        severity = "high"
    strings:
        // Amazon Ion binary format typed value descriptors (0xE0 = Ion 1.0 binary version marker)
        $ion_header = { E0 01 00 EA }
        // GZIP magic bytes
        $gzip_magic = { 1F 8B }
        // Common Ion annotations indicating compressed blob or binary payload
        $gzip_annotation = "gzip" ascii
        $binary_blob = "blob" ascii
        $ion_elided_annotation = "elided" ascii
    condition:
        uint16(0) == 0xE001 and $ion_header at 0 and #gzip_magic >= 1 and any of ($gzip_annotation, $binary_blob, $ion_elided_annotation)
}

Suricata IDS Rule

Suricata rule to detect inbound HTTP POST/PUT requests with Ion content-type that contain GZIP-compressed data (high-level network detection, coarse).

alert http any any -> any any (msg:"ET EXPLOIT Amazon ion-java GZIP Decompression Bomb Attempt (CVE-2026-75936)"; flow:established,to_server; http.method; content:"POST"; http.method; content:"PUT"; http.content_type; content:"application/x-amz-ion"; http.content_type; content:"application/ion"; http.client_body; content:"|1f 8b|"; http.client_body; content:"|e0 01 00 ea|"; classtype:attempted-dos; sid:2026759361; rev:1; reference:cve,2026-75936; metadata:created_at 2026-01-01, updated_at 2026-01-01;)

Note: This Suricata rule detects Ion (binary header E0 01 00 EA) with embedded GZIP magic bytes in HTTP request bodies. Due to protocol parsing limitations, it may require tuning in your environment.

Elastic Detection

Elastic EQL query to detect OutOfMemoryError events in Java application logs that occur in proximity to Ion parsing activity.

sequence by host.name, process.pid with maxspan=5m
  [ any where event.module == "system" and process.name == "java" ]
  [ any where message like "%OutOfMemoryError%" or message like "%GC overhead limit exceeded%"]
  [ any where message like "%ion-java%" or message like "%IonSystem%" or message like "%GZIP%" or message like "%Inflater%"]

Splunk SPL Query

index=* sourcetype=*java* OR sourcetype=*jvm* OR sourcetype=*application*
    (message="*OutOfMemoryError*" OR message="*GC overhead limit exceeded*" OR message="*unable to create new native thread*")
    AND
    (message="*ion*" OR message="*Ion*" OR message="*GZIP*" OR message="*gzip*" OR message="*Inflater*" OR message="*decompress*")
    NOT message="*handled gracefully*" NOT message="*byte limit exceeded*"
    | eval severity="high"
    | eval cve="CVE-2026-75936"
    | eval mitre_tactic="T1499 — Endpoint Denial of Service"
    | table _time, host, source, sourcetype, process, message, severity, cve, mitre_tactic
    | sort - _time

Wazuh OSSEC Rule

<group name="syslog,application,">
  <rule id="120936" level="12">
    <if_sid>531</if_sid>
    <match>OutOfMemoryError|GC overhead limit exceeded|unable to create new native thread</match>
    <description>Potential Amazon ion-java decompression bomb denied-of-service attack (CVE-2026-75936)</description>
    <group>attack.t1499,</group>
    <mitre>
      <id>99999</id>
    </mitre>
  </rule>
  <rule id="120937" level="10">
    <if_sid>120936</if_sid>
    <regex>ion-java|IonSystem|Amazon Ion|GZIP|Inflater|ion</regex>
    <description>Confirmed ion-java GZIP decompression issue detected – CVE-2026-75936</description>
    <group>attack.t1499,</group>
  </rule>
</group>

Note: Adjust if_sid values to match your Wazuh installation baseline. The above rules are examples and require integration with local log parsing for Java applications.

Mitigation & Patch Guidance

Patch Status: No verified patch is available from any tracked source (Patch Confidence: 0/4). The vendor recommendation is to upgrade to ion-java 1.12.0, but no direct download link, commit hash, or confirmed patch diff is currently available from the sources reviewed. Organizations should monitor the Amazon ion-java GitHub repository and Maven Central for the 1.12.0 release.

Immediate Mitigations (apply now):

1. Disable GZIP auto-decompression: If your application uses ion-java and you are unable to upgrade immediately, configure the library with withGzipDecompressionEnabled(false) when creating the IonSystem. This disables automatic GZIP decompression and prevents the attack vector. Note that this will break legitimate compressed Ion payloads; re-architect transport if needed.

2. Set an explicit buffer limit: If GZIP decompression must remain enabled, set withMaximumBufferSize() to a sane limit (e.g., 10–100 MB) when parsing untrusted input. This constrains the decompressed size and causes the library to throw an exception when the limit is exceeded, transforming the DoS into a handled failure.

3. Firewall/input control: For network-facing services, restrict access to trusted IP ranges or add WAF rules that flag/block requests with unusual compression ratios or very large Content-Length headers with small payloads.

4. Resource limits (defense-in-depth): Configure JVM heap limits, container memory limits, and per-request CPU timeouts. Use -XX:MaxRAMPercentage and -XX:MaxMetaspaceSize in the JVM. Set container-level memory limits (e.g., Docker/Kubernetes resources.limits.memory) to prevent a single JVM from exhausting host resources.

5. Request size limits: Enforce an upper bound on the size of incoming Ion documents at the application/gateway layer.

Patch/Upgrade Steps:

1. The fix is expected in ion-java version 1.12.0. The primary remediation is upgrading the dependency.

2. For Maven/Gradle projects, update the dependency declaration in pom.xml or build.gradle to version 1.12.0 or later once released.

3. After upgrading, still apply the configuration recommendations (withGzipDecompressionEnabled(false) and/or withMaximumBufferSize()) for parsing untrusted input, as the vendor explicitly recommends this for defense-in-depth even with the patched version.

Long-Term Hardening:

1. Adopt a "deny by default" compression policy: Automatically disable auto-decompression of any compression format on all internal parsers receiving external data.

2. Implement decompression size limits globally: Even with patched libraries, enforce parsing limits in your application layer as a security best practice.

3. Improve monitoring: Add health checks and anomaly detection that alert on rapid OutOfMemoryError patterns, high GC activity, or unusual JVM memory growth to catch DoS attempts early.

4. Dependency hygiene: Maintain an SBOM (Software Bill of Materials) to track library versions, and subscribe to GitHub release notifications for ion-java for prompt response.

5. Threat intelligence monitoring: Monitor CVE feeds and exploit-db for public PoC development. Although no PoC exists today, the low complexity suggests PoC weaponization is straightforward.

References

1. NVD Entry: CVE-2026-75936 — https://nvd.nist.gov/vuln/detail/CVE-2026-75936
2. Amazon ion-java GitHub Repository — https://github.com/amazon-ion/ion-java
3. Amazon Ion Documentation (GZIP compression and binary format) — https://amazon-ion.github.io/ion-docs/
4. CWE-409: Improper Handling of Highly Compressed Data — https://cwe.mitre.org/data/definitions/409.html
5. MITRE ATT&CK T1499: Endpoint Denial of Service — https://attack.mitre.org/techniques/T1499/

Threat Actor Campaigns: No known threat actor campaigns or exploitation-in-the-wild evidence has been identified. CISA KEV status: Not listed. EPSS: Not yet scored by FIRST.org.