{"id":"CVE-2026-85228","title":"ai.djl/api: Integer overflow in tensor buffer validation in Deep Java Library (CVE-2026-85228)","summary":"A flaw was found in Deep Java Library. Due to an integer overflow during tensor buffer validation, a remote, unauthenticated attacker can send a crafted tensor payload to trigger out-of-bounds memory access. Successful exploitation can all…","severity":"high","cvss":7.4,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","cvssSource":"vendor","cwe":["CWE-125","CWE-190"],"vendor":"Red Hat","product":"Red Hat build of Debezium 3","affected":["build_of_debezium 3"],"published":"2026-09-10","updated":"2026-10-02","sourceUpdated":"2026-10-02T00:40:58+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85228.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85228.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-85228"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2531559"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-85228"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85228"},{"url":"https://aws.amazon.com/security/security-bulletins/2026-106-aws/"},{"url":"https://github.com/deepjavalibrary/djl/releases/tag/v0.37.0"}],"tags":["csaf","vex","red-hat","cve.org"],"epss":0.00539,"epssPercentile":0.45149,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-10T18:20:24.588165Z"},"scores":{"vendor":7.4,"cna":9.1},"ingestedAt":"2026-09-11T16:45:48.028Z","slug":"CVE-2026-85228","body":"## Overview\n\nA flaw was found in Deep Java Library. Due to an integer overflow during tensor buffer validation, a remote, unauthenticated attacker can send a crafted tensor payload to trigger out-of-bounds memory access. Successful exploitation can allow an attacker to obtain sensitive data from adjacent process memory or crash the application, resulting in a Denial of Service (DoS).\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Red Hat build of Debezium 3 · no fix planned: Red Hat build of Debezium 3 · updated 2026-10-02 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85228.json)\n\n**ai.djl/api: Integer overflow in tensor buffer validation in Deep Java Library** — rated Important by Red Hat. Released 2026-09-10, updated 2026-10-02.\n\nAffected:\n\n- Red Hat build of Debezium 3\n\nNo fix planned:\n\n- Red Hat build of Debezium 3\n\n## Remediation\n\nAffected","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":40.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":214818,"id":"CVE-2026-85228","ts":1790927908291,"field":"cvss","old":"9.1","new":"7.4"},{"seq":214817,"id":"CVE-2026-85228","ts":1790927908291,"field":"severity","old":"critical","new":"high"}]}