CVE-2025-11573

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-11573
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-11573.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-11573
Aliases
Published
2025-10-09T17:48:13.305Z
Modified
2026-07-15T01:48:57.624085262Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Denial of Service issue in Amazon.IonDotnet
Details

An infinite loop issue in Amazon.IonDotnet library versions <v1.3.2 may allow a threat actor to cause a denial of service through a specially crafted text input.

To mitigate this issue, users should upgrade to version v1.3.2. As of August 20, 2025, this library has been deprecated and will not receive further updates.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/11xxx/CVE-2025-11573.json",
    "cna_assigner": "AMZN",
    "cwe_ids": [
        "CWE-1286"
    ]
}
References

Affected packages

Git / github.com/amazon-ion/ion-dotnet

Affected ranges

Type
GIT
Repo
https://github.com/amazon-ion/ion-dotnet
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
d116f5574375a61c0257e00af8498b22281cb837
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.3.2"
        }
    ]
}

Affected versions

v0.*
v0.9.0
v0.9.0-beta
v1.*
v1.0.0
v1.1.0
v1.2.0
v1.2.1
v1.2.2
v1.2.3
v1.3.0
v1.3.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-11573.json"