CVE-2026-85228

8.8 highEPSS 0.5%

High (8.8). EPSS 0.5% chance of exploitation in the next 30 days.

An integer overflow in the tensor buffer validation component in Amazon Deep Java Library (DJL) from 0.13.0 through 0.36.0 on all platforms might allow a remote unauthenticated actor to obtain information from adjacent process memory or cause a denial of service via a crafted tensor payload. To remediate this issue, users should upgrade to version 0.37.0 or above.

Severity

CVSS 4.0

8.8 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

9.1 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 45% of CVEs (scores of 2026-10-31)
CWE: CWE-190
Published: 2026-09-10
Modified: 2026-09-10
Record from: the NVD, synced 2026-10-19

References

https://aws.amazon.com/security/security-bulletins/2026-106-aws/
https://github.com/deepjavalibrary/djl/releases/tag/v0.37.0

Check your stack JSON