Description (CNA)
An integer overflow in the tensor buffer validation component in Amazon Deep Java Library (DJL) from 0.13.0 through 0.36.0 on all platforms might allow a remote unauthenticated actor to obtain information from adjacent process memory or cause a denial of service via a crafted tensor payload. To remediate this issue, users should upgrade to version 0.37.0 or above.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Amazon / Deep Java Library | affected 0.13.0 through 0.36.0 |
CWE
CWE-190
References
- https://github.com/deepjavalibrary/djl/releases/tag/v0.37.0
- https://aws.amazon.com/security/security-bulletins/2026-106-aws/
ADP enrichment
No English description supplied.
No references supplied.