CVE-2025-3857 json
Infinite loop condition in Amazon.IonDotnet
published last yr. modified 4mo ago also GHSA-gm2p-wf5c-w3pj , EUVD-2025-12229
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 50%
- public exploits
- 0
- none known
Summary
When reading binary Ion data through Amazon.IonDotnet using the RawBinaryReader class, Amazon.IonDotnet does not check the number of bytes read from the underlying stream while deserializing the binary format. If the Ion data is malformed or truncated, this triggers an infinite loop condition that could potentially result in a denial of service. Users should upgrade to Amazon.IonDotnet version 1.3.1 and ensure any forked or derivative code is patched to incorporate the new fixes.
Patch / fix
- nuget Amazon.IonDotnet 1.3.1
- Amazon Amazon Ion Dotnet 1.3.1
Is CVE-2025-3857 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- last yr.
Exploit prediction
0.62% chance of exploitation in the next 30 days, higher than 50% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| nuget | Amazon.IonDotnet | <1.3.1 |
1.3.1 |
Affected products
- Amazon Amazon Ion Dotnet
Classification
References
-
github.com
/amazon-ion/ion-dotnet/releases/tag/v1.3.1
patch, web
-
github.com
/amazon-ion/ion-dotnet/commit/34a4f5215eceac1bb7bf434c4f2310d64d1b703b
web
-
aws.amazon.com
/security/security-bulletins/AWS-2025-009/
vendor-advisory
-
github.com
/amazon-ion/ion-dotnet/security/advisories/GHSA-gm2p-wf5c-w3pj
third-party-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2025-3857
advisory
-
aws.amazon.com
/security/security-bulletins/AWS-2025-009
web
-
github.com
/amazon-ion/ion-dotnet
package
Sources
- CVE List CVE-2025-3857
- GitHub Advisory GHSA-gm2p-wf5c-w3pj
- NVD CVE-2025-3857
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.