High severity7.5OSV Advisory· Published Apr 21, 2025· Updated Apr 15, 2026
CVE-2025-3857
CVE-2025-3857
Description
When reading binary Ion data through Amazon.IonDotnet using the RawBinaryReader class, Amazon.IonDotnet does not check the number of bytes read from the underlying stream while deserializing the binary format. If the Ion data is malformed or truncated, this triggers an infinite loop condition that could potentially result in a denial of service. Users should upgrade to Amazon.IonDotnet version 1.3.1 and ensure any forked or derivative code is patched to incorporate the new fixes.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
Amazon.IonDotnetNuGet | < 1.3.1 | 1.3.1 |
Affected products
2- Range: v0.9.0, v0.9.0-beta, v1.0.0, …
Patches
Vulnerability mechanics
References
7- github.com/advisories/GHSA-gm2p-wf5c-w3pjghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-3857ghsaADVISORY
- aws.amazon.com/security/security-bulletins/AWS-2025-009ghsaWEB
- github.com/amazon-ion/ion-dotnet/commit/34a4f5215eceac1bb7bf434c4f2310d64d1b703bghsaWEB
- github.com/amazon-ion/ion-dotnet/releases/tag/v1.3.1nvdWEB
- github.com/amazon-ion/ion-dotnet/security/advisories/GHSA-gm2p-wf5c-w3pjnvdWEB
- aws.amazon.com/security/security-bulletins/AWS-2025-009/nvd
News mentions
0No linked articles in our index yet.