CVE intelligence

CVE-2026-85228

Vulnerability intelligence

Published Sep 10, 2026Sources checked Oct 27, 2026

9.1CRITICALCVSS out of 10

What this means

Review the available evidence

CVE-2026-85228 and is rated Critical severity with a CVSS score of 9.1. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

What to do next

Remediation and response

AWS Security Bulletins guidance

Vendor revision: Oct 25, 2026

A fix for this issue has been released and we recommend users of DJL upgrade to version 0.37.0 or later.

CISA KEVNot listedBased on the latest collected catalog

EPSS0.5%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2026-85228?

An integer overflow in the tensor buffer validation component in Amazon Deep Java Library (DJL) from 0.13.0 through 0.36.0 on all platforms might allow a remote unauthenticated actor to obtain information from adjacent process memory or cause a denial of service via a crafted tensor payload.

To remediate this issue, users should upgrade to version 0.37.0 or above.

Source: NVD