{"id":"CVE-2026-85228","kind":"vulnerability","aliases":["CVE-2026-85228"],"related":[],"title":"Deep Java Library: tensor size overflow lets crafted input read memory","description":"CVE-2026-85228 - Integer overflow in tensor buffer validation in Deep Java Library\n\n### CVE-2026-85228 - Integer overflow in tensor buffer validation in Deep Java Library\n\nBulletin ID: 2026-106-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/10/2026 10:30 AM PDT\n\nDescription:\n\nDeep Java Library (DJL) is an open-source, engine-agnostic Java framework for deep learning, developed and maintained by Amazon. AWS identified CVE-2026-85228, an integer overflow in the tensor buffer validation component of DJL on all platforms. A crafted tensor payload declaring a shape whose computed byte size exceeds the 32-bit signed integer range causes the size to wrap, allowing an undersized buffer to pass validation; a subsequent tensor operation then reads out of bounds. If leveraged, a remote, unauthenticated actor could obtain information from adjacent process memory or cause a denial of service. A fix for this issue has been released and we recommend users of DJL upgrade to version 0.37.0 or later.\n\nImpacted versions: >=0.13.0 AND <=0.36.0\n\nResolution:\n\nThis issue has been addressed in ai.djl:api version 0.37.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nThere is no workaround other than upgrading. Until you can upgrade, only accept tensor input from trusted sources and avoid exposing raw-tensor (\"binary mode\") inference endpoints backed by native Java engines to untrusted callers.\n\nReferences:\n\n- CVE-2026-85228\n- GHSA-cqqg-r2fh-7jjm\n\nAcknowledgement:\n\nWe would like to thank Oguzhan Akkaya for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"An integer overflow in DJL's tensor buffer validation lets a crafted tensor shape pass a size check with an undersized buffer, so a later operation reads out of bounds. An unauthenticated remote attacker could leak adjacent process memory or cause a denial of service.","severity":"critical","cvss":9.1,"epss":0.00539,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aws","deep-learning","djl","java","lab-disclosure","package","self-hosted"],"not_affected_if":["default-config","trusted-input-only"],"how_to_check":"- Find the `ai.djl` dependency version in build files (pom.xml, build.gradle) and confirm whether it is between `0.13.0` and `0.36.0`.\n- Check whether the service accepts raw tensor input (binary mode) on endpoints backed by native Java engines.","fix":"- Upgrade `ai.djl:api` to `0.37.0` or later.\n- Patch any forked or derivative DJL code to include the fix.\n- Until upgraded, only accept tensor input from trusted sources and avoid exposing raw-tensor inference endpoints to untrusted callers.","status":"open","published_at":"2026-09-10T17:17:06+00:00","first_seen_at":"2026-10-24T19:43:43+00:00","triaged_at":"2026-10-25T05:29:23+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T05:29:23Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `ai.djl:api` to `0.37.0` or later.\n- Patch any forked or derivative DJL code to include the fix.\n- Until upgraded, only accept tensor input from trusted sources and avoid exposing raw-tensor inference endpoints to untrusted callers.","reach":"internet","title":"Deep Java Library: tensor size overflow lets crafted input read memory","impact":"medium","summary":"An integer overflow in DJL's tensor buffer validation lets a crafted tensor shape pass a size check with an undersized buffer, so a later operation reads out of bounds. An unauthenticated remote attacker could leak adjacent process memory or cause a denial of service.","category":"package","nicknames":[],"who_cares":["java","deep-learning","djl","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Remote attacker reads adjacent process memory or crashes the service","analyst_note":"Check GHSA-cqqg-r2fh-7jjm and the NVD entry for exact affected engines and whether default configs expose raw-tensor endpoints.","how_to_check":"- Find the `ai.djl` dependency version in build files (pom.xml, build.gradle) and confirm whether it is between `0.13.0` and `0.36.0`.\n- Check whether the service accepts raw tensor input (binary mode) on endpoints backed by native Java engines.","needs_analyst":true,"not_affected_if":["trusted-input-only","default-config"],"who_is_affected":"Teams running Deep Java Library between 0.13.0 and 0.36.0 that accept tensor payloads from outside their trust boundary, especially raw-tensor (binary mode) inference endpoints on native Java engines. Systems that only process tensors they generate themselves, or that run a fixed trusted model input, are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000736,"input_tokens":3986,"output_tokens":675,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-106':105C '-2026':13A,16A,77C,90C,147C,317C '-85228':14A,17A,78C,91C,148C,318C '0.13.0':243C '0.36.0':245C '0.37.0':238C,256C '09/10/2026':116C '10':117C '2026':104C '30':118C '32':176C '7jjm':323C 'accept':291C 'acknowledg':324C 'actor':207C 'address':251C 'adjac':67B,212C 'agnost':133C 'ai.djl':253C 'akkaya':331C 'allow':186C 'amazon':143C 'api':254C 'attack':64B 'attent':113C 'avoid':298C 'aw':18B,106C,108C,144C 'aws-security@amazon.com':345C 'back':307C 'binari':303C 'bit':177C 'bound':60B,201C 'buffer':38B,52B,83C,96C,155C,189C 'bulletin':102C 'byte':172C 'caller':314C 'caus':71B,181C,216C 'check':48B 'code':270C 'collabor':333C 'compon':157C 'comput':171C 'concern':351C 'content':109C 'coordin':339C 'could':65B,208C 'cqqg':321C 'craft':8A,42B,164C 'cve':12A,15A,76C,89C,146C,316C 'date':115C 'declar':167C 'deep':1A,20B,86C,99C,122C,137C 'deep-learn':19B 'denial':73B,218C 'deriv':269C 'descript':121C 'develop':139C 'disclosur':26B,341C 'djl':22B,35B,125C,159C,234C 'email':344C 'endpoint':306C 'engin':132C,311C 'engine-agnost':131C 'ensur':265C 'exceed':174C 'expos':299C 'fix':222C,277C 'fork':267C 'framework':135C 'ghsa':320C 'ghsa-cqqg-r2fh-7jjm':319C 'host':30B 'id':103C 'identifi':145C 'impact':241C 'import':111C 'incorpor':274C 'infer':305C 'inform':210C 'input':9A,293C 'integ':32B,79C,92C,150C,179C 'issu':225C,248C,336C 'java':2A,23B,87C,100C,123C,134C,310C 'lab':25B 'lab-disclosur':24B 'later':55B,240C 'latest':262C 'leak':66B 'learn':21B,138C 'let':7A,40B 'leverag':203C 'librari':3A,88C,101C,124C 'like':327C 'maintain':141C 'memori':11A,69B,214C 'mode':304C 'nativ':309C 'new':276C 'obtain':209C 'oguzhan':330C 'open':129C 'open-sourc':128C 'oper':56B,196C 'overflow':6A,33B,80C,93C,151C 'packag':27B 'pass':45B,191C 'patch':272C 'payload':166C 'pdt':120C 'platform':162C 'pleas':343C 'process':68B,213C,342C 'public':114C 'question':349C 'r2fh':322C 'rang':180C 'raw':301C 'raw-tensor':300C 'read':10A,57B,198C 'recommend':231C,258C 'refer':315C 'releas':228C 'remot':63B,205C 'requir':112C 'resolut':246C 'scope':107C 'secur':348C 'self':29B 'self-host':28B 'servic':75B,220C 'shape':44B,169C 'sign':178C 'size':5A,47B,173C,183C 'sourc':130C,296C 'subsequ':194C 'tensor':4A,37B,43B,82C,95C,154C,165C,195C,292C,302C 'thank':329C 'trust':295C 'type':110C 'unauthent':62B,206C 'unders':51B,188C 'untrust':313C 'upgrad':235C,259C,285C,289C 'user':232C 'valid':39B,84C,97C,156C,192C 'version':237C,242C,255C,263C 'vulner':340C 'whose':170C 'workaround':278C,282C 'would':326C 'wrap':185C","nicknames":[],"mitigations":[],"who_affected":"Teams running Deep Java Library between 0.13.0 and 0.36.0 that accept tensor payloads from outside their trust boundary, especially raw-tensor (binary mode) inference endpoints on native Java engines. Systems that only process tensors they generate themselves, or that run a fixed trusted model input, are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-10T17:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ff89ba41-3aa1-4d27-914a-91399e9639e5","poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-106-aws/#CVE-2026-85228","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-106-aws/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T19:43:43+00:00","fetched_at":"2026-10-24T19:43:43+00:00","note":"AWS: CVE-2026-85228 - Integer overflow in tensor buffer validation in Deep Java Library"},{"source":"nvd","external_id":"CVE-2026-85228","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85228","severity":null,"published_at":"2026-09-10T17:17:06+00:00","modified_at":"2026-09-10T19:54:25+00:00","first_seen_at":"2026-10-24T20:15:27+00:00","fetched_at":"2026-10-24T20:15:27+00:00","note":null},{"source":"epss","external_id":"CVE-2026-85228","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85228","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[{"id":2961,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-106-aws/","title":"AWS: CVE-2026-85228 - Integer overflow in tensor buffer validation in Deep Java Library","kind":"advisory","source":"lab","text":"CVE-2026-85228 - Integer overflow in tensor buffer validation in Deep Java Library\n\n### CVE-2026-85228 - Integer overflow in tensor buffer validation in Deep Java Library\n\nBulletin ID: 2026-106-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/10/2026 10:30 AM PDT\n\nDescription:\n\nDeep Java Library (DJL) is an open-source, engine-agnostic Java framework for deep learning, developed and maintained by Amazon. AWS identified CVE-2026-85228, an integer overflow in the tensor buffer validation component of DJL on all platforms. A crafted tensor payload declaring a shape whose computed byte size exceeds the 32-bit signed integer range causes the size to wrap, allowing an undersized buffer to pass validation; a subsequent tensor operation then reads out of bounds. If leveraged, a remote, unauthenticated actor could obtain information from adjacent process memory or cause a denial of service. A fix for this issue has been released and we recommend users of DJL upgrade to version 0.37.0 or later.\n\nImpacted versions: >=0.13.0 AND <=0.36.0\n\nResolution:\n\nThis issue has been addressed in ai.djl:api version 0.37.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nThere is no workaround other than upgrading. Until you can upgrade, only accept tensor input from trusted sources and avoid exposing raw-tensor (\"binary mode\") inference endpoints backed by native Java engines to untrusted callers.\n\nReferences:\n\n- CVE-2026-85228\n- GHSA-cqqg-r2fh-7jjm\n\nAcknowledgement:\n\nWe would like to thank Oguzhan Akkaya for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}