CVE-2026-85228 - Integer overflow in tensor buffer validation in Deep Java Library

In plain language

What this advisory means

Amazon's Deep Java Library (DJL), a tool used for deep learning, has a security problem called CVE-2026-85228. This problem happens when DJL wrongly checks the size of a data buffer that stores tensors—multidimensional data arrays used in AI. If someone sends a crafted tensor with specially made dimensions, the size calculation can overflow, tricking the system into accepting a smaller buffer than needed. Then, when DJL uses this buffer, it may read memory outside the intended area, potentially leaking information or causing the program to crash. AWS fixed this by updating DJL to version 0.37.0 or later and recommends users upgrade as soon as possible.

Technical explanation

How the issue affects the environment

The vulnerability CVE-2026-85228 in the Deep Java Library arises from an integer overflow during tensor buffer validation. When a tensor shape is declared with dimensions whose total byte size calculation exceeds the maximum value of a 32-bit signed integer, the size calculation wraps around to a smaller (negative or positive) number due to overflow. This overflow allows an undersized buffer to pass validation checks. Subsequent tensor operations then read or write outside the allocated buffer bounds, leading to out-of-bounds memory accesses. An attacker remotely crafting such tensor payloads can execute out-of-bounds reads, potentially exposing adjacent memory content or causing denial of service. The issue has been corrected in DJL version 0.37.0 by ensuring correct size calculations and validation without overflow.

Operational impact

Why teams should care

This flaw can be exploited remotely without authentication, making it a serious risk. An attacker could access sensitive information from memory adjacent to tensor buffers or crash applications using Deep Java Library. This impacts any business relying on DJL for deep learning models, especially those exposing inference endpoints to external data. Failure to upgrade leaves systems vulnerable to data leaks or service disruptions, potentially harming business reputation, causing compliance issues, and incurring remediation costs.

Affected and fixed releases

Temporary risk reduction

No complete workaround exists other than upgrading. As a temporary measure, only accept tensor inputs from trusted sources and avoid exposing raw-tensor binary inference endpoints backed by native Java engines to untrusted users until upgraded.

Evidence and validation checklist

• AWS Security Bulletin 2026-106-AWS describes the integer overflow and its consequences.
• AWS recommends upgrading DJL to version 0.37.0 as a fix.
• The issue allows out-of-bounds read leading to information disclosure or denial of service.
• Affected versions include DJL versions from 0.13.0 up to but not including 0.37.0.
• No workaround other than upgrading is provided; temporary mitigation involves restricting input sources.