Vulnpedia
← All CVEs

CVE-2026-85228

HIGH 8.8 ALL-YEARS

Published 2026-09-10 · Last modified 2026-09-10 · AMZN · NVD: Awaiting Analysis

An integer overflow in the tensor buffer validation component in Amazon Deep Java Library (DJL) from 0.13.0 through 0.36.0 on all platforms might allow a remote unauthenticated actor to obtain information from adjacent process memory or cause a denial of service via a crafted tensor payload. To remediate this issue, users should upgrade to version 0.37.0 or above.

ELEVATED IMPACT

Severe if exploited (CVSS 8.8), but no confirmed exploitation. Patch on a normal cadence.

Exploitation likelihood

0.5%chance of exploitation in 30 days · 45th percentile

○ In CISA KEV○ Catalogued PoC◆ SSVC: exploitation none, automatable yes

Impact if exploited

8.8CVSS 4.0 · HIGH · CNA

  • ConfidentialityHigh
  • IntegrityNone
  • AvailabilityHigh

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable
  • ✓Requirements: No special attack requirements

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Affected

Vendors Amazon

Products Deep Java Library

Weakness (CWE)

  • CWE-190: Integer overflow or wraparound

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

References and research data (JSON)

Vendor product assessments

  • Red Hat Build of Debezium 3.6 · fixed

    Vendor assessment for this product only.

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream project addressed this flaw in Deep Java Library 0.37.0; affected Red Hat Integration components are remediated through the delegated update process, and users should apply updated packages once available.
    Red Hat · CVE-2026-85228 · Updated 2026-10-16T11:52:36+00:00
  • api as a component of Red Hat build of Debezium 3 · known affected

    Vendor assessment for this product only.

    pkg:maven/ai.djl/[email protected]

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream project addressed this flaw in Deep Java Library 0.37.0; affected Red Hat Integration components are remediated through the delegated update process, and users should apply updated packages once available.
    • none available: Affected
    Red Hat · CVE-2026-85228 · Updated 2026-10-16T11:52:36+00:00

All CVSS metrics

  • CRITICAL 9.1 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
  • HIGH 8.8 v4.0 · CNA Primary
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
  • HIGH 8.8 v4.0 · NVD Secondary
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • CRITICAL 9.1 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

References

Patches & mitigations

Advisories

Technical & other

Sources: NVD · CVE.org · All sources and attribution · EPSS