Amazon ion-java contains an improper handling of highly compressed data in its GZIP auto‑decompression handler. A crafted compressed Ion document can expand to an arbitrarily large size when decompressed, exhausting memory and causing the application to become unresponsive or crash. This is a classic memory‑amplification denial of service vulnerability and is classified as CWE‑409. The impact is strictly on availability, with no direct effect on confidentiality or integrity.

The affected product is Amazon Ion Java. All versions built before 1.12.0 are vulnerable. The official advisory points to release 1.12.0 as the first fix. No specific sub‑versions are listed, so any deployment of Amazon Ion Java older than 1.12.0 should be considered at risk.

The CVSS score of 8.7 places this issue in the high severity range. EPSS data is currently unavailable, but high CVSS and the nature of the bug suggest a non‑negligible exploitation probability in environments that automatically decompress GZIP data from untrusted sources. This vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the target application accepts or downloads Ion documents and performs automatic GZIP decompression, which is common in many integration points.