CVE-2024-37902

10.0 criticalEPSS 0.8%

Critical (10.0). EPSS 0.8% chance of exploitation in the next 30 days. Fixed in ai.djl:api 0.28.0.

DeepJavaLibrary(DJL) is an Engine-Agnostic Deep Learning Framework in Java. DJL versions 0.1.0 through 0.27.0 do not prevent absolute path archived artifacts from inserting archived files directly into the system, overwriting system files. This is fixed in DJL 0.28.0 and patched in DJL Large Model Inference containers version 0.27.0. Users are advised to upgrade.

Severity

CVSS 3.1

10.0 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 56% of CVEs (scores of 2026-10-31)
CWE: CWE-22
Published: 2024-06-17
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-w877-jfw7-46rj	Maven	ai.djl:api	>=0.1.0 <0.28.0	0.28.0

References

https://github.com/deepjavalibrary/djl/releases/tag/v0.28.0
https://github.com/deepjavalibrary/djl/security/advisories/GHSA-w877-jfw7-46rj
https://github.com/deepjavalibrary/djl/releases/tag/v0.28.0
https://github.com/deepjavalibrary/djl/security/advisories/GHSA-w877-jfw7-46rj

Check your stack JSON