CVE-2026-85786

Amazon ion-java before 1.12.1 improperly handles highly compressed data (CWE-409, a decompression amplification or "zip bomb" class flaw): a small attacker-crafted GZIP-compressed Ion document expands to an arbitrarily large size when the library automatically decompresses it. The flaw is triggered by submitting the crafted compressed Ion document to any service or application that parses untrusted Ion input with the library's GZIP auto-decompression path active; the opt-out mechanism added for the earlier issue CVE-2026-75936 does not fully cover this path. An attacker gains only availability impact (CVSS 4.0 VA:H with no confidentiality or integrity impact), i.e., CPU and memory exhaustion leading to denial of service of the affected process. Any deployment embedding ion-java versions prior to 1.12.1 and accepting Ion-formatted data from untrusted sources is affected. There is currently no known public proof of concept, the flaw is not in CISA KEV, and EPSS is low (0.3%, 26th percentile), indicating limited near-term exploitation risk.

What to do: Upgrade ion-java to 1.12.1, including shaded/vendored copies, and verify exposure by scanning Maven/Gradle dependency trees for ion-java versions below 1.12.1. Where an immediate upgrade is not possible, disable or restrict GZIP auto-decompression for untrusted Ion input (the mechanism incompletely gated by the CVE-2026-75936 opt-out) and enforce compressed payload size limits at the ingestion boundary. No public PoC or in-the-wild exploitation is known, so routine patching cadence is reasonable, but prioritize internet-facing services that accept Ion documents from untrusted clients.