CVE-2026-75935

CVE-2026-75935 in Amazon ion-java exposes a preallocation-based denial-of-service vulnerability in the library's cursor implementation. When parsing Ion binary documents, the cursor preallocates heap memory based on declared-length fields from the untrusted input stream before validating those lengths against reasonable bounds. This is a design choice—streaming parsers need expected document sizes to allocate efficiently—but it creates a DoS vector that application developers are unlikely to anticipate since the memory risk lives inside the library, not their code. The vulnerability is not novel; it follows a documented lineage through XML parsers, JSON parsers, Protocol Buffers, and Cap'n Proto implementations, representing a known failure mode that keeps recurring because the security community addresses individual CVEs rather than the underlying design pattern. The EPSS of 0.00441 indicates this sits below most scanning thresholds today, meaning the population of exposed systems is largely unmeasured—and likely to persist for years given the remediation cascade through transitive dependencies. Upgrade to 1.12.0, but examine what the patch actually does: if it only adds bounds checking without changing the preallocation strategy, similar cursor paths may remain exploitable through different input vectors. The more important question is whether this patch represents a genuine architectural shift toward lazy allocation or just another targeted fix that leaves the underlying assumption intact. High-throughput applications should benchmark against the new behavior, as the allocation strategy change can measurably affect latency under load. In distributed data pipelines, remember that cursor failures propagate upstream as backpressure and may leave downstream consumers with truncated or corrupted Ion documents that lack error signals to trigger retry logic.

Reviewed through automated stages and approved by a human before publication.