CVE-2026-85228

    Dashboard / Vulnerabilities / CVE-2026-85228

    CVE-2026-85228

    Published: 10 Sept 2026Last Modified: 11 Sept 2026

    Summary: Integer overflow in tensor buffer validation in Deep Java Library

    Details: An integer overflow in the tensor buffer validation component in Amazon Deep Java Library (DJL) from 0.13.0 through 0.36.0 on all platforms might allow a remote unauthenticated actor to obtain information from adjacent process memory or cause a denial of service via a crafted tensor payload. To remediate this issue, users should upgrade to version 0.37.0 or above.

    References: https://aws.amazon.com/security/security-bulletins/2026-106-aws/, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85228.json, https://github.com/deepjavalibrary/djl/releases/tag/v0.37.0, https://nvd.nist.gov/vuln/detail/CVE-2026-85228

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- c8c20070b7e09b3f402cea63ca899bdb9763df99
    Fixed -None

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-85228 | CVE-DB