Live › vulnerability › GHSA-cqqg-r2fh-7jjm
Go to dashboardDeep Java Library (DJL) miscalculates tensor buffer sizes from crafted shapes, so an undersized buffer passes validation and a later operation reads out of bounds. An unauthenticated remote attacker could read adjacent process memory or cause a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 19:43 UTC. All times on this page are UTC.
Teams running DJL between 0.13.0 and that accept tensor payloads from outside their trust boundary, especially raw-tensor (binary mode) inference endpoints on native Java engines. Applications that only process trusted tensor input or that run on versions outside the affected range can skip it.
0.36.0No product ranges from the sources yet.
ai.djl:api version in your Maven or Gradle build file; affected versions are >=0.13.0 and <=0.36.0.ai.djl:api to 0.37.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-85228 - Integer overflow in tensor buffer validation in Deep Java Library
Bulletin ID: 2026-106-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/10/2026 10:30 AM PDT
Description:
Deep Java Library (DJL) is an open-source, engine-agnostic Java framework for deep learning, developed and maintained by Amazon. AWS identified CVE-2026-85228, an integer overflow in the tensor buffer validation component of DJL on all platforms. A crafted tensor payload declaring a shape whose computed byte size exceeds the 32-bit signed integer range causes the size to wrap, allowing an undersized buffer to pass validation; a subsequent tensor operation then reads out of bounds. If leveraged, a remote, unauthenticated actor could obtain information from adjacent process memory or cause a denial of service. A fix for this issue has been released and we recommend users of DJL upgrade to version 0.37.0 or later.
Impacted versions: >=0.13.0 AND <=0.36.0
Resolution:
This issue has been addressed in ai.djl:api version 0.37.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds:
There is no workaround other than upgrading. Until you can upgrade, only accept tensor input from trusted sources and avoid exposing raw-tensor ("binary mode") inference endpoints backed by native Java engines to untrusted callers.
References:
Acknowledgement:
We would like to thank Oguzhan Akkaya for collaborating on this issue through the coordinated vulnerability disclosure process.
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("GHSA-cqqg-r2fh-7jjm")