The Amazon Ion Java library exhibits an uncontrolled memory allocation flaw in its Ion stream cursor. A crafted Ion binary document that contains a declared‑length field can force the library to preallocate an excessively large block of heap memory. This abnormal allocation can cause the Java process to become unresponsive or crash, leading to a denial of service that impacts availability. The vulnerability falls under the memory‑allocation error category (CWE‑789).

Versions of Amazon Ion Java earlier than 1.12.0 are affected, including all releases that use the library for parsing Ion binaries. Any Java application that incorporates the library and processes unknown Ion data is vulnerable.

The supported CVSS score is 8.7, indicating high severity. The EPSS score is not available, so exploitation likelihood is uncertain but potentially significant given the trivial nature of creating a malicious Ion binary. The vulnerability is not listed in CISA KEV. Likely attack vectors involve sending a crafted Ion document to any service or component that uses the library, possibly without requiring elevated privileges. Because the flaw triggers solely by malformed input, the risk to availability is substantial if the application does not apply constraints on memory usage.