AWS Security Bulletins: CVE-2026-75935 and CVE-2026-75936 - Issue with Amazon ion-java - Memory-amplification denial of service

AWS Security Bulletins published a security advisory titled “CVE-2026-75935 and CVE-2026-75936 - Issue with Amazon ion-java - Memory-amplification denial of service”.

At a glance

Publisher

AWS Security Bulletins

CVEs

CVE-2026-75935, CVE-2026-75936, CVE-2026-85786

What the advisory says

Bulletin ID: 2026-083-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 08/18/2026 12:30 PM PDT Description: ion-java is a Java library that implements the Amazon Ion data format specification. We identified CVE-2026-75935, memory-amplification denial of service via declared-length preallocation, and CVE-2026-75936, memory-amplification denial of service via highly compressed data expansion. Affected versions: < 1.12.0 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

What should you do?

• Read the full vendor advisory linked below and confirm whether you run affected versions.
• Schedule the recommended update, prioritising internet-facing systems.
• Watch for exploitation reports; unpatched edge devices are frequent targets.

What to do and how to stay safe: CVE-2026-75935

• Vulnerability severity scores ignore your specific architecture and context.
• Exploitability depends on network exposure and user behavior, not just code flaws.
• Prioritization requires continuous asset inventory and threat intelligence alignment.

Risk-based vulnerability management focuses your limited resources on the flaws that actually threaten your business. Start by mapping your critical assets and checking for active exploits to prioritize your backlog.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.