CVE-2026-85228
An integer overflow in the tensor buffer validation component in Amazon Deep Java Library (DJL) from 0.13.0 through 0.36.0 on all platforms might allow a remote unauthenticated actor to obtain information from adjacent process memory or cause a denial of service via a crafted tensor payload. To remediate this issue, users should upgrade to version 0.37.0 or above.
- Score
- CVSS 3.1 9.1 Critical
- Status
- Awaiting Analysis - ff89ba41-3aa1-4d27-914a-91399e9639e5
- Published
- 2026-09-10
- Last modified
- 2026-09-10
- Weaknesses
- CWE-190
Affected products
References
- https://aws.amazon.com/security/security-bulletins/2026-106-aws/
- https://github.com/deepjavalibrary/djl/releases/tag/v0.37.0
