Skip to content
Fencer Vulns
high 7.5

CVE-2024-21634 json

Ion Java StackOverflow vulnerability

published 2024-01-03 2 y ago modified 2026-09-10 1 mo ago also GHSA-264p-99wq-f4j6 , EUVD-2024-0219

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.8%
EPSS 0.8% chance of exploitation in 30 days, percentile 57%
public exploits
0
none known

Summary

Amazon Ion is a Java implementation of the Ion data notation. Prior to version 1.10.5, a potential denial-of-service issue exists in `ion-java` for applications that use `ion-java` to deserialize Ion text encoded data, or deserialize Ion text or binary encoded data into the `IonValue` model and then invoke certain `IonValue` methods on that in-memory representation. An actor could craft Ion data that, when loaded by the affected application and/or processed using the `IonValue` model, results in a `StackOverflowError` originating from the `ion-java` library. The patch is included in `ion-java` 1.10.5. As a workaround, do not load data which originated from an untrusted source or that could have been tampered with.

Patch / fix

  • maven com.amazon.ion:ion-java 1.10.5
  • amazon ion 1.10.5
  • eap8-wildfly jboss enterprise application platform 8.0 8.0.3-13.GA_redhat_00007.1.el8eap
  • eap8-wildfly jboss enterprise application platform 8.0 8.0.3-13.GA_redhat_00007.1.el9eap
  • eap8-undertow jboss enterprise application platform 8.0 2.3.14-2.SP2_redhat_00001.1.el8eap
  • eap8-undertow jboss enterprise application platform 8.0 2.3.14-2.SP2_redhat_00001.1.el9eap
  • eap8-amazon-ion-java jboss enterprise application platform 8.0 1.11.9-2.redhat_00001.1.el8eap
  • eap8-amazon-ion-java jboss enterprise application platform 8.0 1.11.9-2.redhat_00001.1.el9eap
  • eap8-wildfly-modules jboss enterprise application platform 8.0 8.0.3-13.GA_redhat_00007.1.el8eap
  • eap8-wildfly-modules jboss enterprise application platform 8.0 8.0.3-13.GA_redhat_00007.1.el9eap

red hat advisories RHSA-2024:7441

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-21634 updated cvss 7.5

ion-java: ion-java: Ion Java StackOverflow vulnerability

  • Red Hat Logging Subsystem for Red Hat OpenShift ion-java
    affected: workaround, no fix available
  • Red Hat Fuse 7 software.amazon.ion/ion-java software.amazon.ion/ion-java
    affected: workaround, no fix planned “Will not fix”
  • Red Hat JBoss EAP 8.0 for RHEL 8 eap8-wildfly 8.0.3-13.GA_redhat_00007.1.el8eap, eap8-undertow 2.3.14-2.SP2_redhat_00001.1.el8eap, eap8-amazon-ion-java 1.11.9-2.redhat_00001.1.el8eap, eap8-wildfly-modules 8.0.3-13.GA_redhat_00007.1.el8eap, eap8-wildfly-java-jdk11 8.0.3-13.GA_redhat_00007.1.el8eap, eap8-wildfly-java-jdk17 8.0.3-13.GA_redhat_00007.1.el8eap, +3 more Red Hat JBoss EAP 8.0 for RHEL 9 eap8-wildfly 8.0.3-13.GA_redhat_00007.1.el9eap, eap8-undertow 2.3.14-2.SP2_redhat_00001.1.el9eap, eap8-amazon-ion-java 1.11.9-2.redhat_00001.1.el9eap, eap8-wildfly-modules 8.0.3-13.GA_redhat_00007.1.el9eap, eap8-wildfly-java-jdk11 8.0.3-13.GA_redhat_00007.1.el9eap, eap8-wildfly-java-jdk17 8.0.3-13.GA_redhat_00007.1.el9eap, +3 more
    fixed: vendor fix RHSA-2024:7441
  • Red Hat JBoss Enterprise Application Platform 8
    fixed: vendor fix RHSA-2024:7442
  • Red Hat build of Apache Camel for Spring Boot 3 software.amazon.ion/ion-java software.amazon.ion/ion-java Red Hat build of Apache Camel for Spring Boot 4 software.amazon.ion/ion-java software.amazon.ion/ion-java Red Hat Build of Keycloak software.amazon.ion/ion-java software.amazon.ion/ion-java Red Hat build of Quarkus software.amazon.ion/ion-java software.amazon.ion/ion-java Red Hat Integration Camel K 1 software.amazon.ion/ion-java software.amazon.ion/ion-java Red Hat JBoss Data Grid 7 software.amazon.ion/ion-java software.amazon.ion/ion-java
    +1 more products
    Red Hat JBoss Enterprise Application Platform 7 ion-java
    not affected: vulnerable code not present
  • Red Hat JBoss Enterprise Application Platform 8 ion-java
    not affected: component not present
  • Red Hat JBoss Enterprise Application Platform Expansion Pack ion-java
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.83% chance of exploitation in the next 30 days, higher than 57% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
maven com.amazon.ion:ion-java
<1.10.5
1.10.5
maven software.amazon.ion:ion-java
all versions
 no fix listed

Affected products

  • amazon-ion ion-java

Classification

Weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.