{"id":"GHSA-cqqg-r2fh-7jjm","kind":"vulnerability","aliases":["GHSA-cqqg-r2fh-7jjm"],"related":[],"title":"CVE-2026-85228 - Integer overflow in tensor buffer validation in Deep Java Library","description":"CVE-2026-85228 - Integer overflow in tensor buffer validation in Deep Java Library\n\n### CVE-2026-85228 - Integer overflow in tensor buffer validation in Deep Java Library\n\nBulletin ID: 2026-106-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/10/2026 10:30 AM PDT\n\nDescription:\n\nDeep Java Library (DJL) is an open-source, engine-agnostic Java framework for deep learning, developed and maintained by Amazon. AWS identified CVE-2026-85228, an integer overflow in the tensor buffer validation component of DJL on all platforms. A crafted tensor payload declaring a shape whose computed byte size exceeds the 32-bit signed integer range causes the size to wrap, allowing an undersized buffer to pass validation; a subsequent tensor operation then reads out of bounds. If leveraged, a remote, unauthenticated actor could obtain information from adjacent process memory or cause a denial of service. A fix for this issue has been released and we recommend users of DJL upgrade to version 0.37.0 or later.\n\nImpacted versions: >=0.13.0 AND <=0.36.0\n\nResolution:\n\nThis issue has been addressed in ai.djl:api version 0.37.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nThere is no workaround other than upgrading. Until you can upgrade, only accept tensor input from trusted sources and avoid exposing raw-tensor (\"binary mode\") inference endpoints backed by native Java engines to untrusted callers.\n\nReferences:\n\n- CVE-2026-85228\n- GHSA-cqqg-r2fh-7jjm\n\nAcknowledgement:\n\nWe would like to thank Oguzhan Akkaya for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"Deep Java Library (DJL) miscalculates tensor buffer sizes from crafted shapes, so an undersized buffer passes validation and a later operation reads out of bounds. An unauthenticated remote attacker could read adjacent process memory or cause a denial of service.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aws","deep-learning","djl","java","lab-disclosure","package","self-hosted"],"not_affected_if":["outside-affected-versions","trusted-input-only"],"how_to_check":"- Check the `ai.djl:api` version in your Maven or Gradle build file; affected versions are `>=0.13.0` and `<=0.36.0`.\n- Look for services that accept raw tensor input (\"binary mode\") inference endpoints on native Java engines.","fix":"- Upgrade `ai.djl:api` to `0.37.0` or later.\n- Patch any forked or derivative DJL code with the upstream fixes.\n- Until upgraded, accept tensor input only from trusted sources and do not expose raw-tensor inference endpoints to untrusted callers.","status":"open","published_at":null,"first_seen_at":"2026-10-24T19:43:43+00:00","triaged_at":"2026-10-25T04:50:15+00:00","updated_at":"2026-10-25T22:57:19+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:50:15Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `ai.djl:api` to `0.37.0` or later.\n- Patch any forked or derivative DJL code with the upstream fixes.\n- Until upgraded, accept tensor input only from trusted sources and do not expose raw-tensor inference endpoints to untrusted callers.","reach":"internet","title":"Deep Java Library: integer overflow in tensor validation leaks process memory","impact":"medium","summary":"Deep Java Library (DJL) miscalculates tensor buffer sizes from crafted shapes, so an undersized buffer passes validation and a later operation reads out of bounds. An unauthenticated remote attacker could read adjacent process memory or cause a denial of service.","category":"package","nicknames":[],"who_cares":["java","deep-learning","djl","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Remote unauthenticated attacker reads adjacent process memory or crashes the service","analyst_note":"","how_to_check":"- Check the `ai.djl:api` version in your Maven or Gradle build file; affected versions are `>=0.13.0` and `<=0.36.0`.\n- Look for services that accept raw tensor input (\"binary mode\") inference endpoints on native Java engines.","needs_analyst":false,"not_affected_if":["trusted-input-only","outside-affected-versions"],"who_is_affected":"Teams running DJL between `0.13.0` and `0.36.0` that accept tensor payloads from outside their trust boundary, especially raw-tensor (binary mode) inference endpoints on native Java engines. Applications that only process trusted tensor input or that run on versions outside the affected range can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000706,"input_tokens":3955,"output_tokens":621,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-106':106C '-2026':2A,78C,91C,148C,318C '-85228':3A,79C,92C,149C,319C '0.13.0':244C '0.36.0':246C '0.37.0':239C,257C '09/10/2026':117C '10':118C '2026':105C '30':119C '32':177C '7jjm':18A,23A,324C 'accept':292C 'acknowledg':325C 'actor':208C 'address':252C 'adjac':68B,213C 'agnost':134C 'ai.djl':254C 'akkaya':332C 'allow':187C 'amazon':144C 'api':255C 'attack':65B 'attent':114C 'avoid':299C 'aw':24B,107C,109C,145C 'aws-security@amazon.com':346C 'back':308C 'binari':304C 'bit':178C 'bound':61B,202C 'buffer':8A,43B,51B,84C,97C,156C,190C 'bulletin':103C 'byte':173C 'caller':315C 'caus':72B,182C,217C 'code':271C 'collabor':334C 'compon':158C 'comput':172C 'concern':352C 'content':110C 'coordin':340C 'could':66B,209C 'cqqg':16A,21A,322C 'craft':46B,165C 'cve':1A,77C,90C,147C,317C 'date':116C 'declar':168C 'deep':11A,26B,37B,87C,100C,123C,138C 'deep-learn':25B 'denial':74B,219C 'deriv':270C 'descript':122C 'develop':140C 'disclosur':32B,342C 'djl':28B,40B,126C,160C,235C 'email':345C 'endpoint':307C 'engin':133C,312C 'engine-agnost':132C 'ensur':266C 'exceed':175C 'expos':300C 'fix':223C,278C 'fork':268C 'framework':136C 'ghsa':15A,20A,321C 'ghsa-cqqg-r2fh-7jjm':14A,19A,320C 'host':36B 'id':104C 'identifi':146C 'impact':242C 'import':112C 'incorpor':275C 'infer':306C 'inform':211C 'input':294C 'integ':4A,80C,93C,151C,180C 'issu':226C,249C,337C 'java':12A,29B,38B,88C,101C,124C,135C,311C 'lab':31B 'lab-disclosur':30B 'later':56B,241C 'latest':263C 'learn':27B,139C 'leverag':204C 'librari':13A,39B,89C,102C,125C 'like':328C 'maintain':142C 'memori':70B,215C 'miscalcul':41B 'mode':305C 'nativ':310C 'new':277C 'obtain':210C 'oguzhan':331C 'open':130C 'open-sourc':129C 'oper':57B,197C 'overflow':5A,81C,94C,152C 'packag':33B 'pass':52B,192C 'patch':273C 'payload':167C 'pdt':121C 'platform':163C 'pleas':344C 'process':69B,214C,343C 'public':115C 'question':350C 'r2fh':17A,22A,323C 'rang':181C 'raw':302C 'raw-tensor':301C 'read':58B,67B,199C 'recommend':232C,259C 'refer':316C 'releas':229C 'remot':64B,206C 'requir':113C 'resolut':247C 'scope':108C 'secur':349C 'self':35B 'self-host':34B 'servic':76B,221C 'shape':47B,170C 'sign':179C 'size':44B,174C,184C 'sourc':131C,297C 'subsequ':195C 'tensor':7A,42B,83C,96C,155C,166C,196C,293C,303C 'thank':330C 'trust':296C 'type':111C 'unauthent':63B,207C 'unders':50B,189C 'untrust':314C 'upgrad':236C,260C,286C,290C 'user':233C 'valid':9A,53B,85C,98C,157C,193C 'version':238C,243C,256C,264C 'vulner':341C 'whose':171C 'workaround':279C,283C 'would':327C 'wrap':186C","nicknames":[],"mitigations":[],"who_affected":"Teams running DJL between `0.13.0` and `0.36.0` that accept tensor payloads from outside their trust boundary, especially raw-tensor (binary mode) inference endpoints on native Java engines. Applications that only process trusted tensor input or that run on versions outside the affected range can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":null,"kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-106-aws/#GHSA-cqqg-r2fh-7jjm","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-106-aws/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T19:43:43+00:00","fetched_at":"2026-10-25T22:58:00+00:00","note":"AWS: CVE-2026-85228 - Integer overflow in tensor buffer validation in Deep Java Library"}],"documents":[{"id":2961,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-106-aws/","title":"AWS: CVE-2026-85228 - Integer overflow in tensor buffer validation in Deep Java Library","kind":"advisory","source":"lab","text":"CVE-2026-85228 - Integer overflow in tensor buffer validation in Deep Java Library\n\n### CVE-2026-85228 - Integer overflow in tensor buffer validation in Deep Java Library\n\nBulletin ID: 2026-106-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/10/2026 10:30 AM PDT\n\nDescription:\n\nDeep Java Library (DJL) is an open-source, engine-agnostic Java framework for deep learning, developed and maintained by Amazon. AWS identified CVE-2026-85228, an integer overflow in the tensor buffer validation component of DJL on all platforms. A crafted tensor payload declaring a shape whose computed byte size exceeds the 32-bit signed integer range causes the size to wrap, allowing an undersized buffer to pass validation; a subsequent tensor operation then reads out of bounds. If leveraged, a remote, unauthenticated actor could obtain information from adjacent process memory or cause a denial of service. A fix for this issue has been released and we recommend users of DJL upgrade to version 0.37.0 or later.\n\nImpacted versions: >=0.13.0 AND <=0.36.0\n\nResolution:\n\nThis issue has been addressed in ai.djl:api version 0.37.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nThere is no workaround other than upgrading. Until you can upgrade, only accept tensor input from trusted sources and avoid exposing raw-tensor (\"binary mode\") inference endpoints backed by native Java engines to untrusted callers.\n\nReferences:\n\n- CVE-2026-85228\n- GHSA-cqqg-r2fh-7jjm\n\nAcknowledgement:\n\nWe would like to thank Oguzhan Akkaya for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}