CyberRota Analysis
AI-GeneratedThe GZIP auto-decompression handler in Amazon ion-java prior to version 1.12.0 is vulnerable to denial of service attacks due to improper handling of highly compressed data, allowing remote attackers to exploit crafted compressed Ion documents that expand excessively upon decompression. Organizations using this Java library, particularly those handling untrusted input, should prioritize upgrading to version 1.12.0 and implementing recommended configurations to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Improper handling of highly compressed data in the GZIP auto-decompression handler in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression. To remediate this issue, users should upgrade to version 1.12.0 and configure withGzipDecompressionEnabled(false) and/or set an explicit withMaximumBufferSize() when parsing untrusted input.