CVE-2025-3857: Infinite loop condition in Amazon.IonDotnet
7.5
Basic Information
C#Technical Details
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Amazon.IonDotnet | nuget | < 1.3.1 | 1.3.1 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability description explicitly mentions that the RawBinaryReader class is affected and that an infinite loop can occur when reading binary Ion data if it's malformed or truncated. The provided commit 34a4f5215eceac1bb7bf434c4f2310d64d1b703b shows a modification in the Amazon.IonDotnet/Internals/Binary/RawBinaryReader.cs file, specifically within the ReadAll method. The patch introduces a check for amount == 0 inside a while (length > 0) loop. If this.input.Read returns 0 (indicating end-of-stream or no data read) while length is still positive, the original code would loop infinitely because length would not decrease. The added check throws an UnexpectedEofException, preventing the infinite loop. Therefore, the ReadAll method is the vulnerable function as it contained the logic susceptible to the infinite loop under specific input conditions.