CVE-2026-85228CWE-190

CVE-2026-85228

Critical · published September 10, 2026

CVSS v3.1
9.1
EPSS
1%
Percentile
44.6
In the wild
Unconfirmed
What it is

An integer overflow in the tensor buffer validation component in Amazon Deep Java Library (DJL) from 0.13.0 through 0.36.0 on all platforms might allow a remote unauthenticated actor to obtain information from adjacent process memory or cause a denial of service via a crafted tensor payload.

To remediate this issue, users should upgrade to version 0.37.0 or above.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CVSS v4.0
8.8 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00539 · 44.6th percentile
Weakness
CWE-190 · Integer Overflow or Wraparound
Published
2026-09-10T21:17Z
References (2)
https://aws.amazon.com/security/security-bulletins/2026-106-aws/ · ff89ba41-3aa1-4d27-914a-91399e9639e5https://github.com/deepjavalibrary/djl/releases/tag/v0.37.0 · ff89ba41-3aa1-4d27-914a-91399e9639e5
EPSS history
Timeline
  • 12 SEP 03:22Z
    EPSS moved — → 0%
    epss
  • 10 SEP 17:03Z
    Integer overflow in tensor buffer validation in Deep Java Library
    cvelistv5