CVE-2025-3857CWE-502CWE-835

Infinite loop condition in Amazon.IonDotnet

High · published April 21, 2025

CVSS v4.0
8.7
EPSS
1%
Percentile
49.1
In the wild
Unconfirmed
What it is

When reading binary Ion data through Amazon.IonDotnet using the RawBinaryReader class, Amazon.IonDotnet does not check the number of bytes read from the underlying stream while deserializing the binary format. If the Ion data is malformed or truncated, this triggers an infinite loop condition that could potentially result in a denial of service. Users should upgrade to Amazon.IonDotnet version 1.3.1 and ensure any forked or derivative code is patched to incorporate the new fixes.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00622 · 49.1th percentile
Weaknesses
CWE-502 · Deserialization of Untrusted Data; CWE-835 · Loop with Unreachable Exit Condition ('Infinite Loop')
Published
2025-04-21T15:13Z
EPSS history
Timeline
  • 21 APR 15:13Z
    Infinite loop condition in Amazon.IonDotnet
    cvelistv5