Amazon Ion vulnerabilities

• amazon amazon.extensions.s3.encryption RSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 Encryption Client for .NET CVE-2026-110310 6.0 MediumOctober 14, 2026
• amazon ion-python Uncontrolled recursion in the Ion reader in Amazon Ion Python CVE-2026-104020 8.7 HighOctober 1, 2026
• amazon ion-java Incomplete fix for CVE-2026-75936 memory-amplification denial of service in Amazon ion-java CVE-2026-85786 8.7 HighSeptember 4, 2026
• amazon ion-c Uncontrolled recursion in the Ion reader in Amazon Ion-C before 1.1.6 CVE-2026-84851 8.7 HighSeptember 2, 2026
• amazon application load balancer HTTP/2 Stream Parser Confusion Body-Inspection Bypass in AWS Application Load Balancer with AWS WAF CVE-2026-13763 7.9 HighJune 29, 2026
• mariadb, mariadb foundation server, amazon aurora mysql +3 more +5 more MariaDB Server Audit Plugin Comment Handling Bypass CVE-2026-3494 Public exploitFix available 5.3 MediumMarch 3, 2026
• amazon ion-c An uninitialized stack read issue exists in Amazon Ion-C versions <v1.1.4 that may allow a threat actor to craft data and serialize it to Ion text in such a way that sensitive data in memory could be… CVE-2025-12829 6.9 MediumNovember 7, 2025
• amazon amazon.iondotnet Denial of Service issue in Amazon.IonDotnet CVE-2025-11573 Fix available 8.7 HighOctober 9, 2025
• amazon q developer vs code extension Inert Malicious script injected into Amazon Q Developer Visual Studio Code (VS Code) Extension CVE-2025-8217 5.1 MediumJuly 30, 2025
• amazon ion dotnet Infinite loop condition in Amazon.IonDotnet CVE-2025-3857 Fix available 8.7 HighApril 21, 2025
• amazon amazon.applicationloadbalancer.identity.aspnetcore middleware Lack of JWT issuer and signer validation CVE-2024-10125 6.9 MediumOctober 21, 2024
• amazon ion, amazon-ion ion-java +1 more Ion Java StackOverflow vulnerability CVE-2024-21634 Fix available 7.5 HighJanuary 3, 2024
• amazon opensearch notifications, opensearch-project notifications +1 more OpenSearch Notifications is vulnerable to Server-Side Request Forgery (SSRF) CVE-2022-41906 7.7 HighNovember 11, 2022
• amazon aws encryption sdk AWS Encryption SDK for Java Improper Verification of Cryptographic Signature CVE-2024-23680 Fix available 5.3 MediumJune 1, 2021
• amazon aws sdk for javascipt, aws shared configuration file loader +1 more Prototype Pollution CVE-2020-28472 Fix available 7.3 HighJanuary 19, 2021
• amazon aws encryption sdk, aws sdk +1 more Robustness weakness in AWS KMS and Encryption SDKs CVE-2020-8897 Fix available 4.8 MediumNovember 16, 2020
• amazon web services cloudformation bootstrap The Amazon Web Services (AWS) CloudFormation bootstrap tools package (aka aws-cfn-bootstrap)... CVE-2017-9450 7.8 HighOctober 30, 2017