CVE-2025-3857— Infinite loop condition in Amazon.IonDotnet
Quick assessment
Affected
Amazon Amazon Ion Dotnet
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
ion-dotnet是amazon-ion开源的一个A.NET实现的Amazon Ion。 ion-dotnet 1.3.1之前版本存在安全漏洞，该漏洞源于RawBinaryReader类未检查读取字节数，可能导致无限循环和拒绝服务。
Possible ATT&CK Techniques 1 AI
T1496 · Resource Hijacking
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-3857
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Infinite loop condition in Amazon.IonDotnet
Source: CVE Program / CVE List V5
Vulnerability Description
When reading binary Ion data through Amazon.IonDotnet using the RawBinaryReader class, Amazon.IonDotnet does not check the number of bytes read from the underlying stream while deserializing the binary format. If the Ion data is malformed or truncated, this triggers an infinite loop condition that could potentially result in a denial of service. Users should upgrade to Amazon.IonDotnet version 1.3.1 and ensure any forked or derivative code is patched to incorporate the new fixes.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
不可达退出条件的循环(无限循环)
Source: CVE Program / CVE List V5
Vulnerability Title
ion-dotnet 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
ion-dotnet是amazon-ion开源的一个A.NET实现的Amazon Ion。 ion-dotnet 1.3.1之前版本存在安全漏洞，该漏洞源于RawBinaryReader类未检查读取字节数，可能导致无限循环和拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Amazon | Amazon Ion Dotnet | 0 ~ 1.3.1 | - |
|
II. Public POCs for CVE-2025-3857
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
Qwen3.6-35B-A3B
· 10092 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2025-3857
请登录查看更多情报信息。
Vendor Advisories for CVE-2025-3857 (2)
-
CVE-2025-3857 - Infinite loop condition in Amazon.IonDotnet vendor-advisory
IV. Related Vulnerabilities
Same vendor: Amazon
-
CVE-2026-104020
Uncontrolled recursion in the Ion reader in Amazon Ion Pytho -
CVE-2026-95985
Kiro IDE Allows Agentic Writes to Global Configurations Whil -
CVE-2026-94384
Missing Authorization in sfExecuteAWSService Lambda Dispatch -
CVE-2023-32803
Amazon ca-certificates 权限许可和访问控制问题漏洞 -
CVE-2026-85228
Integer overflow in tensor buffer validation in Deep Java Li
Same weakness: CWE-835
-
CVE-2026-107577
Loop with Unreachable Exit Condition ('Infinite Loop') in hM -
CVE-2026-106164
Infinite Loop in Telerik Document Processing XLS Import -
CVE-2026-106568
ImageMagick: Infinite Loop when reading a crafted XMP profil -
CVE-2026-107168
M17n-lib: parser infinite loop on malformed utf-8 in count_u -
CVE-2026-106121
RabbitMQ: JSONReader in the default JSON-RPC mapper never te
V. Comments for CVE-2025-3857
No comments yet