---
id: "CVE-2026-85228"
kind: "vulnerability"
aliases: ["CVE-2026-85228"]
title: "Deep Java Library: tensor size overflow lets crafted input read memory"
severity: "critical"
cvss: 9.1
epss: 0.00539
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["aws", "deep-learning", "djl", "java", "lab-disclosure", "package", "self-hosted"]
not_affected_if: ["default-config", "trusted-input-only"]
published_at: "2026-09-10T17:17:06+00:00"
first_seen_at: "2026-10-24T19:43:43+00:00"
updated_at: "2026-10-25T12:38:49+00:00"
sources: [{"source": "lab", "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-106-aws/", "first_seen_at": "2026-10-24T19:43:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85228", "first_seen_at": "2026-10-24T20:15:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-85228", "first_seen_at": "2026-10-25T12:38:49+00:00"}]
---

# Deep Java Library: tensor size overflow lets crafted input read memory

An integer overflow in DJL's tensor buffer validation lets a crafted tensor shape pass a size check with an undersized buffer, so a later operation reads out of bounds. An unauthenticated remote attacker could leak adjacent process memory or cause a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Find the `ai.djl` dependency version in build files (pom.xml, build.gradle) and confirm whether it is between `0.13.0` and `0.36.0`.
- Check whether the service accepts raw tensor input (binary mode) on endpoints backed by native Java engines.

## Fix

- Upgrade `ai.djl:api` to `0.37.0` or later.
- Patch any forked or derivative DJL code to include the fix.
- Until upgraded, only accept tensor input from trusted sources and avoid exposing raw-tensor inference endpoints to untrusted callers.

## Timeline

- 2026-10-24T19:43:43+00:00 lab https://aws.amazon.com/security/security-bulletins/rss/2026-106-aws/ — AWS: CVE-2026-85228 - Integer overflow in tensor buffer validation in Deep Java Library
- 2026-10-24T20:15:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-85228
- 2026-10-25T12:38:49+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-85228

## Documents

- [advisory] AWS: CVE-2026-85228 - Integer overflow in tensor buffer validation in Deep Java Library https://aws.amazon.com/security/security-bulletins/rss/2026-106-aws/

## From the sources

CVE-2026-85228 - Integer overflow in tensor buffer validation in Deep Java Library

### CVE-2026-85228 - Integer overflow in tensor buffer validation in Deep Java Library

Bulletin ID: 2026-106-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/10/2026 10:30 AM PDT

Description:

Deep Java Library (DJL) is an open-source, engine-agnostic Java framework for deep learning, developed and maintained by Amazon. AWS identified CVE-2026-85228, an integer overflow in the tensor buffer validation component of DJL on all platforms. A crafted tensor payload declaring a shape whose computed byte size exceeds the 32-bit signed integer range causes the size to wrap, allowing an undersized buffer to pass validation; a subsequent tensor operation then reads out of bounds. If leveraged, a remote, unauthenticated actor could obtain information from adjacent process memory or cause a denial of service. A fix for this issue has been released and we recommend users of DJL upgrade to version 0.37.0 or later.

Impacted versions: >=0.13.0 AND <=0.36.0

Resolution:

This issue has been addressed in ai.djl:api version 0.37.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds:

There is no workaround other than upgrading. Until you can upgrade, only accept tensor input from trusted sources and avoid exposing raw-tensor ("binary mode") inference endpoints backed by native Java engines to untrusted callers.

References:

- CVE-2026-85228
- GHSA-cqqg-r2fh-7jjm

Acknowledgement:

We would like to thank Oguzhan Akkaya for collaborating on this issue through the coordinated vulnerability disclosure process.

 Please email aws-security@amazon.com with any security questions or concerns.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_