Skip to content
OpenAdvisories
High · 7.5 CVE-2024-21634 EUVD-2024-0219GHSA-264p-99wq-f4j6

Ion Java StackOverflow vulnerability

Published Jan 3, 2024 · Updated Nov 3, 2025 · Assigned by GitHub_M

Description

Amazon Ion is a Java implementation of the Ion data notation. Prior to version 1.10.5, a potential denial-of-service issue exists in `ion-java` for applications that use `ion-java` to deserialize Ion text encoded data, or deserialize Ion text or binary encoded data into the `IonValue` model and then invoke certain `IonValue` methods on that in-memory representation. An actor could craft Ion data that, when loaded by the affected application and/or processed using the `IonValue` model, results in a `StackOverflowError` originating from the `ion-java` library. The patch is included in `ion-java` 1.10.5. As a workaround, do not load data which originated from an untrusted source or that could have been tampered with.

Affected products

VendorProductAffectedFixed
amazon-ion ion-java < 1.10.5 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Red Hat JBoss EAP 8 eap8-amazon-ion-java 1.11.9-2.redhat_00001.1.el8eap RHSA-2024:7441
Red Hat JBoss EAP 8 eap8-eap-product-conf-parent +1 800.3.1-2.GA_redhat_00002.1.el8eap RHSA-2024:7441
Red Hat JBoss EAP 8 eap8-undertow 2.3.14-2.SP2_redhat_00001.1.el8eap RHSA-2024:7441
Red Hat JBoss EAP 8 eap8-wildfly +4 8.0.3-13.GA_redhat_00007.1.el8eap RHSA-2024:7441

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling gradle-stage0 No fix yet —
Wolfi rolling wavefront-proxy +3 13.4-r6 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven com.amazon.ion:ion-java < 1.10.5 1.10.5 GHSA-264p-99wq-f4j6
Maven software.amazon.ion:ion-java all versions — GHSA-264p-99wq-f4j6

Advisories 4

References