Amazon.IonDotnet Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in the Amazon.IonDotnet library, specifically in versions prior to 1.3.2. This issue arises from an infinite loop created by the parser when it encounters specially crafted text input. As a result, a threat actor could potentially cause a service disruption. The library has been deprecated as of August 20, 2025, and will not receive further updates.

Impact

Exploitation of this vulnerability leads to an infinite loop in the text parser, causing a denial-of-service condition by consuming resources and potentially causing the application to become unresponsive.

Remediation

Users are advised to upgrade to Amazon.IonDotnet version 1.3.2, which addresses this vulnerability. For any forked or derivative code, ensure to incorporate the latest fixes.