CVE-2026-85228
Received Received - Intake

Integer Overflow in Amazon Deep Java Library

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: AMZN

Description
An integer overflow in the tensor buffer validation component in Amazon Deep Java Library (DJL) from 0.13.0 through 0.36.0 on all platforms might allow a remote unauthenticated actor to obtain information from adjacent process memory or cause a denial of service via a crafted tensor payload. To remediate this issue, users should upgrade to version 0.37.0 or above.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-85228
EUVD
EUVD-2026-75623

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
amazon deep_java_library 0.37.0
amazon deep_java_library From 0.37.0 (inc)
amazon deep_java_library From 0.13.0 (inc) to 0.36.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-190 The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-85228 is an integer overflow vulnerability in Amazon Deep Java Library (DJL) versions 0.13.0 through 0.36.0. It occurs in the tensor buffer validation component where a crafted tensor payload with a shape causing the computed byte size to exceed 32-bit integer range passes validation. This leads to undersized buffers and subsequent out-of-bounds reads during tensor operations.

Detection Guidance

Detection primarily involves checking the installed version of Amazon Deep Java Library (DJL). If your system uses DJL versions 0.13.0 through 0.36.0, it is vulnerable. Use commands like 'pip show djl' or 'mvn dependency:tree | grep djl' to check the installed version.

Impact Analysis

A remote unauthenticated attacker could exploit this to access adjacent process memory or cause a denial of service via a specially crafted tensor payload. The vulnerability affects all platforms using vulnerable DJL versions.

Mitigation Strategies

Upgrade Amazon Deep Java Library (DJL) to version 0.37.0 or later. This can be done via package managers like 'pip install --upgrade djl' or by updating Maven dependencies. Avoid exposing raw-tensor inference endpoints to untrusted sources until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85228. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart