CVE-2026-85228

CVE-2026-85228 is an integer overflow (CWE-190) in the tensor buffer validation component of Amazon's Deep Java Library (DJL), affecting all versions from 0.13.0 through 0.36.0 on all platforms. An attacker triggers the flaw by sending a crafted tensor payload to an application that processes it with a vulnerable DJL version. A successful attack may let a remote, unauthenticated actor read information from adjacent process memory (information disclosure) or crash the application (denial of service); the CVSS 4.0 score of 8.8 (High) reflects high confidentiality and availability impact with no privileges or user interaction required. Anyone embedding DJL 0.13.0-0.36.0 in a service that accepts tensor data from untrusted sources is affected. There is no evidence of exploitation so far: the flaw is not in CISA's KEV and no public proof-of-concept is known.

What to do: Upgrade DJL to version 0.37.0 or later and rebuild/redeploy any application bundling a vulnerable version. In the meantime, check whether your services accept tensor payloads from untrusted or remote sources and restrict or validate such input; note that the flaw can leak adjacent process memory, so treat data processed by vulnerable versions as potentially exposed until patched.