CVE-2026-85228— Integer overflow in tensor buffer validation in Deep Java Library
Quick assessment
Affected
Amazon Deep Java Library
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Amazon Deep Java Library (DJL) 版本 0.13.0 至 0.36.0 的张量缓冲区验证组件中存在整数溢出漏洞，可能允许远程未认证的攻击者通过构造的张量负载，从相邻进程内存中获取信息或导致服务拒绝（DoS）。 要修复此问题，用户应升级到 0.37.0 或更高版本。
Possible ATT&CK Techniques 3 AI
T1202 · Indirect Command Execution T1029 · Scheduled Transfer T1564 · Hide ArtifactsAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Amazon | Deep Java Library | 0.13.0≤ 0.36.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-85228
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Integer overflow in tensor buffer validation in Deep Java Library
Source: CVE Program / CVE List V5
Vulnerability Description
An integer overflow in the tensor buffer validation component in Amazon Deep Java Library (DJL) from 0.13.0 through 0.36.0 on all platforms might allow a remote unauthenticated actor to obtain information from adjacent process memory or cause a denial of service via a crafted tensor payload.
To remediate this issue, users should upgrade to version 0.37.0 or above.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
整数溢出或超界折返
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Amazon | Deep Java Library | 0.13.0 ~ 0.36.0 | - |
|
II. Public POCs for CVE-2026-85228
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-85228
请登录查看更多情报信息。
Vendor Pages for CVE-2026-85228 (2)
IV. Related Vulnerabilities
Same vendor: Amazon
-
CVE-2026-85787
An incomplete list of disallowed inputs in the SQL validatio -
CVE-2026-85786
Incomplete fix for CVE-2026-75936 memory-amplification denia -
CVE-2026-85656
OS command injection in Amazon log4j-cve-2021-44228-hotpatch -
CVE-2026-85654
Code injection in the CDK generator in Amazon awslabs.dynamo -
CVE-2026-84851
Uncontrolled recursion in the Ion reader in Amazon Ion-C bef
Same weakness: CWE-190
-
CVE-2026-16174
Netskope Endpoint DLP Driver Integer Overflow Leading to Ker -
CVE-2026-88035
Heap buffer overflow via wrapped size check during SASL user -
CVE-2026-88015
rclone local: crafted Range request against a translated sym -
CVE-2026-87823
zstd-jni 1.1.1 through 1.5.7-13 Out-of-Bounds Read via Direc -
CVE-2026-56711
VLC media player 3.0.0 through 3.0.23 Heap Out-of-Bounds Wri
V. Comments for CVE-2026-85228
No comments yet