{"id":"CVE-2024-21634","aliases":["EUVD-2024-0219","GHSA-264p-99wq-f4j6","RHSA-2024:7441","ROOT-APP-MAVEN-CVE-2024-21634"],"status":"published","title":"Ion Java StackOverflow vulnerability","description":"Amazon Ion is a Java implementation of the Ion data notation. Prior to version 1.10.5, a potential denial-of-service issue exists in `ion-java` for applications that use `ion-java` to deserialize Ion text encoded data, or deserialize Ion text or binary encoded data into the `IonValue` model and then invoke certain `IonValue` methods on that in-memory representation. An actor could craft Ion data that, when loaded by the affected application and/or processed using the `IonValue` model, results in a `StackOverflowError` originating from the `ion-java` library. The patch is included in `ion-java` 1.10.5. As a workaround, do not load data which originated from an untrusted source or that could have been tampered with.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00827,"percentile":0.57765,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2024-01-03T22:04:08Z","modified":"2026-10-28T02:30:51Z","fixes":[{"ecosystem":"Maven","package":"com.amazon.ion:ion-java","fixed_in":["1.10.5"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"software.amazon.ion:ion-java","fixed_in":["1.10.5"],"sources":["ghsa"]},{"ecosystem":"Root:Maven","package":"io.root.software.amazon.ion:ion-java","fixed_in":["1.0.2-root.io.1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"software.amazon.ion:ion-java","fixed_in":["1.0.2-aikido.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.amazon.ion:ion-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.5"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"software.amazon.ion:ion-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.5"}]}]},{"source":"osv","ecosystem":"Maven","package":"com.amazon.ion:ion-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.5"}]}],"versions":["1.10.0","1.10.1","1.10.2","1.10.3","1.10.4","1.4.0","1.5.0","1.5.1","1.6.0","1.6.1","1.7.0","1.7.1","1.8.0","1.8.1","1.8.2","1.8.3","1.9.0","1.9.1","1.9.2","1.9.3","1.9.4","1.9.5","1.9.6"]},{"source":"osv","ecosystem":"Maven","package":"software.amazon.ion:ion-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3","1.1.0","1.1.1","1.1.2","1.2.0","1.3.0","1.3.1","1.4.0","1.5.0","1.5.1"]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-amazon-ion-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.9-2.redhat_00001.1.el8eap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-eap-product-conf-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:800.3.1-2.GA_redhat_00002.1.el8eap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-eap-product-conf-wildfly-ee-feature-pack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:800.3.1-2.GA_redhat_00002.1.el8eap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-undertow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.14-2.SP2_redhat_00001.1.el8eap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-wildfly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.3-13.GA_redhat_00007.1.el8eap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-wildfly-java-jdk11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.3-13.GA_redhat_00007.1.el8eap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-wildfly-java-jdk17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.3-13.GA_redhat_00007.1.el8eap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-wildfly-java-jdk21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.3-13.GA_redhat_00007.1.el8eap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-wildfly-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.3-13.GA_redhat_00007.1.el8eap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-amazon-ion-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.9-2.redhat_00001.1.el9eap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-eap-product-conf-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:800.3.1-2.GA_redhat_00002.1.el9eap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-eap-product-conf-wildfly-ee-feature-pack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:800.3.1-2.GA_redhat_00002.1.el9eap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-undertow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.14-2.SP2_redhat_00001.1.el9eap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-wildfly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.3-13.GA_redhat_00007.1.el9eap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-wildfly-java-jdk11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.3-13.GA_redhat_00007.1.el9eap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-wildfly-java-jdk17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.3-13.GA_redhat_00007.1.el9eap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-wildfly-java-jdk21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.3-13.GA_redhat_00007.1.el9eap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-wildfly-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.3-13.GA_redhat_00007.1.el9eap"}]}],"bundled":2},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.software.amazon.ion:ion-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-root.io.1"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"software.amazon.ion:ion-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-aikido.1"}]}]}],"products":[{"vendor":"amazon","product":"ion"},{"vendor":"amazon-ion","product":"ion-java"}],"references":[{"url":"https://github.com/amazon-ion/ion-java/security/advisories/GHSA-264p-99wq-f4j6","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","article"]},{"url":"https://security.netapp.com/advisory/ntap-20241108-0002/","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21634","tags":["advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20241108-0002","tags":["web"]},{"url":"https://github.com/advisories/GHSA-264p-99wq-f4j6"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/21xxx/CVE-2024-21634.json","tags":["advisory"]},{"url":"https://github.com/amazon-ion/ion-java","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2024:7441","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/8.0/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2304311","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2305290","tags":["report"]},{"url":"https://issues.redhat.com/browse/JBEAP-27711","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-27754","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_7441.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-7885","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-7885","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-7885","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-21634","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-21634","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-21634","title":"Ion Java StackOverflow vulnerability","description":"Amazon Ion is a Java implementation of the Ion data notation. Prior to version 1.10.5, a potential denial-of-service issue exists in `ion-java` for applications that use `ion-java` to deserialize Ion text encoded data, or deserialize Ion text or binary encoded data into the `IonValue` model and then invoke certain `IonValue` methods on that in-memory representation. An actor could craft Ion data that, when loaded by the affected application and/or processed using the `IonValue` model, results in a `StackOverflowError` originating from the `ion-java` library. The patch is included in `ion-java` 1.10.5. As a workaround, do not load data which originated from an untrusted source or that could have been tampered with.","status":"published","published":"2024-01-03T22:46:03.585Z","modified":"2025-11-03T21:53:26.42Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:34:04.681315Z"}],"euvd":[{"id":"EUVD-2024-0219","description":"Amazon Ion is a Java implementation of the Ion data notation. Prior to version 1.10.5, a potential denial-of-service issue exists in `ion-java` for applications that use `ion-java` to deserialize Ion text encoded data, or deserialize Ion text or binary encoded data into the `IonValue` model and then invoke certain `IonValue` methods on that in-memory representation. An actor could craft Ion data that, when loaded by the affected application and/or processed using the `IonValue` model, results in a `StackOverflowError` originating from the `ion-java` library. The patch is included in `ion-java` 1.10.5. As a workaround, do not load data which originated from an untrusted source or that could have been tampered with.","status":"published","published":"2024-01-03T22:46:03Z","modified":"2025-11-03T21:53:26Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:30.274226Z"}],"ghsa":[{"id":"GHSA-264p-99wq-f4j6","title":"Ion Java StackOverflow vulnerability","description":"### Impact\n\nA potential denial-of-service issue exists in `ion-java` for applications that use `ion-java` to:\n\n* Deserialize Ion text encoded data, or\n* Deserialize Ion text or binary encoded data into the `IonValue` model and then invoke certain `IonValue` methods on that in-memory representation.\n\nAn actor could craft Ion data that, when loaded by the affected application and/or processed using the `IonValue` model, results in a `StackOverflowError` originating from the `ion-java` library.\n\nImpacted versions: \u003c1.10.5\n\n### Patches\n\nThe patch is included in `ion-java` \u003e= 1.10.5.\n\n### Workarounds\n\nDo not load data which originated from an untrusted source or that could have been tampered with. **Only load data you trust.**\n\n----\n\nIf you have any questions or comments about this advisory, we ask that you contact AWS/Amazon Security via our vulnerability reporting page [1] or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.\n\n[1] https://aws.amazon.com/security/vulnerability-reporting","status":"published","published":"2024-01-03T22:04:08Z","modified":"2025-11-04T16:48:19Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:39:06.376137Z"}],"nvd":[{"id":"CVE-2024-21634","description":"Amazon Ion is a Java implementation of the Ion data notation. Prior to version 1.10.5, a potential denial-of-service issue exists in `ion-java` for applications that use `ion-java` to deserialize Ion text encoded data, or deserialize Ion text or binary encoded data into the `IonValue` model and then invoke certain `IonValue` methods on that in-memory representation. An actor could craft Ion data that, when loaded by the affected application and/or processed using the `IonValue` model, results in a `StackOverflowError` originating from the `ion-java` library. The patch is included in `ion-java` 1.10.5. As a workaround, do not load data which originated from an untrusted source or that could have been tampered with.","status":"published","published":"2024-01-03T23:15:08.943Z","modified":"2026-06-17T07:09:53.523Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:09:30.070039Z"}],"osv":[{"id":"CVE-2024-21634","title":"Ion Java StackOverflow vulnerability","description":"Amazon Ion is a Java implementation of the Ion data notation. Prior to version 1.10.5, a potential denial-of-service issue exists in `ion-java` for applications that use `ion-java` to deserialize Ion text encoded data, or deserialize Ion text or binary encoded data into the `IonValue` model and then invoke certain `IonValue` methods on that in-memory representation. An actor could craft Ion data that, when loaded by the affected application and/or processed using the `IonValue` model, results in a `StackOverflowError` originating from the `ion-java` library. The patch is included in `ion-java` 1.10.5. As a workaround, do not load data which originated from an untrusted source or that could have been tampered with.","status":"published","published":"2024-01-03T22:46:03.585Z","modified":"2026-10-28T02:30:51.028378842Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:44:38.577405Z"},{"id":"GHSA-264p-99wq-f4j6","title":"Ion Java StackOverflow vulnerability","description":"### Impact\n\nA potential denial-of-service issue exists in `ion-java` for applications that use `ion-java` to:\n\n* Deserialize Ion text encoded data, or\n* Deserialize Ion text or binary encoded data into the `IonValue` model and then invoke certain `IonValue` methods on that in-memory representation.\n\nAn actor could craft Ion data that, when loaded by the affected application and/or processed using the `IonValue` model, results in a `StackOverflowError` originating from the `ion-java` library.\n\nImpacted versions: \u003c1.10.5\n\n### Patches\n\nThe patch is included in `ion-java` \u003e= 1.10.5.\n\n### Workarounds\n\nDo not load data which originated from an untrusted source or that could have been tampered with. **Only load data you trust.**\n\n----\n\nIf you have any questions or comments about this advisory, we ask that you contact AWS/Amazon Security via our vulnerability reporting page [1] or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.\n\n[1] https://aws.amazon.com/security/vulnerability-reporting","status":"published","published":"2024-01-03T22:04:08Z","modified":"2026-09-10T03:50:09.258018779Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:33.956911Z"},{"id":"RHSA-2024:7441","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0 security update","status":"published","published":"2024-10-01T11:00:41Z","modified":"2026-10-14T10:05:14Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"ROOT-APP-MAVEN-CVE-2024-21634","title":"CVE-2024-21634 in io.root.software.amazon.ion:ion-java - Patched by Root","description":"Root has patched CVE-2024-21634 in the io.root.software.amazon.ion:ion-java package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-06-29T12:06:10Z","modified":"2026-06-29T20:00:13.091184755Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:27.066589Z"}]}}