CVE-2026-85228

CVSS 9.1 (critical) · published 2026-09-10

An integer overflow in the tensor buffer validation component in Amazon Deep Java Library (DJL) from 0.13.0 through 0.36.0 on all platforms might allow a remote unauthenticated actor to obtain information from adjacent process memory or cause a denial of service via a crafted tensor payload. To remediate this issue, users should upgrade to version 0.37.0 or above.

Weakness: CWE-190

Source: NVD CVE-2026-85228

References

• https://aws.amazon.com/security/security-bulletins/2026-106-aws/
• https://github.com/deepjavalibrary/djl/releases/tag/v0.37.0

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.