Amazon DJL CVE-2026-85228

The target DJL instance must be reachable over a network and must accept tensor input from the attacker without requiring authentication (consistent with CVSS AV:N/PR:N). The vulnerability is in the core tensor buffer validation path, which is exercised whenever the library processes incoming tensor payloads - no non-default feature flag or special configuration is required. Any DJL inference or model-serving deployment that accepts externally supplied tensor data is in scope across all platforms for versions 0.13.0 through 0.36.0. Exploitation is bounded by network reachability: DJL services deployed exclusively on internal networks protected by firewalls or VPN access controls face substantially lower real-world risk. No user interaction is needed, and no privilege escalation is required to trigger the overflow.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VA:H) represents a high-severity, zero-friction network-exploitable flaw with no authentication requirement and no special preconditions, meaning any DJL model-serving endpoint reachable from an untrusted network is at meaningful risk; even a mid-sized municipal IT team in malbork running an internal ML inference service should treat this as urgent if the endpoint is not firewall-restricted. The dual impact - adjacent process memory exposure (C:H) and denial of service (A:H) - extends the threat beyond a simple crash and could expose heap-resident model weights, inference outputs, or other in-process data. No EPSS score was provided in the intelligence, and no CISA KEV listing or public proof-of-concept has been identified, which tempers immediate exploitation likelihood. Practical risk is strongly modulated by network exposure: DJL instances behind internal network controls serving only trusted clients face substantially lower real-world risk than externally accessible inference APIs.

An attacker identifies a DJL model-serving endpoint accessible over the network and sends a crafted tensor payload with malformed size or dimension values engineered to overflow integer arithmetic in the buffer validation path. The overflow causes the computed buffer boundary to wrap to a smaller value, bypassing the validation check and enabling the library to read from adjacent heap memory - potentially exposing model parameters, in-flight inference data, or other process memory contents. Alternatively, the corrupted state crashes the inference service, resulting in denial of service. No public exploit code has been identified at time of analysis.