CVE-2025-11573

Denial of Service issue in Amazon.IonDotnet

State: Published
Severity: 8.7 High
Published: Oct 9, 2025
Updated: Oct 9, 2025
Reserved: Oct 9, 2025

Description

An infinite loop issue in Amazon.IonDotnet library versions <v1.3.2 may allow a threat actor to cause a denial of service through a specially crafted text input.

To mitigate this issue, users should upgrade to version v1.3.2. As of August 20, 2025, this library has been deprecated and will not receive further updates.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N	AMZN
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	AMZN

Weaknesses

CWE-1286 Improper Validation of Syntactic Correctness of Input

Affected Products

Product	Versions
Amazon.IonDotnetAmazon	before 1.3.2Affected

References

https://github.com/amazon-ion/ion-dotnet/releases/tag/v1.3.2patchproduct
https://aws.amazon.com/security/security-bulletins/AWS-2025-022/vendor-advisory
https://github.com/amazon-ion/ion-dotnet/security/advisories/GHSA-q5r6-9qwq-g2wjthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.