Description

An integer overflow in the tensor buffer validation component in Amazon Deep Java Library (DJL) from 0.13.0 through 0.36.0 on all platforms might allow a remote unauthenticated actor to obtain information from adjacent process memory or cause a denial of service via a crafted tensor payload. To remediate this issue, users should upgrade to version 0.37.0 or above.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-10T17:17:06.437Z",
  "pubdate": "2026-09-10T17:17:06.437Z",
  "executiveSummary": "Amazon Deep Java Library (DJL) is susceptible to an integer overflow vulnerability within its tensor buffer validation component, identified in versions 0.13.0 through 0.36.0.\nThe vulnerability allows remote, unauthenticated actors to trigger memory corruption scenarios by submitting a specially crafted tensor payload.\nSuccessful exploitation can lead to two primary security outcomes: the unauthorized disclosure of sensitive data residing in adjacent process memory or a complete denial-of-service (DoS) condition caused by application instability.\nThe risk is considered significant for applications that process untrusted tensor inputs, as the attack requires no prior authentication or administrative privileges.\nOrganizations using the affected versions of DJL are advised to prioritize updating to version 0.37.0 or higher to eliminate the underlying validation flaw.",
  "technicalDetails": "The vulnerability originates within the tensor buffer validation logic of the Amazon Deep Java Library (DJL). An integer overflow occurs when the library calculates the required buffer size for an incoming tensor payload without proper boundary checks or overflow detection mechanisms.\nWhen a maliciously crafted tensor payload is processed, the internal arithmetic operation used to compute the memory allocation size wraps around due to integer overflow. This results in the allocation of a buffer smaller than the actual data payload size.\nThe attack flow begins when a remote unauthenticated attacker transmits a malformed tensor data structure to an application utilizing the vulnerable DJL component. As the application attempts to copy or deserialize the payload into the inadequately sized memory buffer, a heap-based buffer overflow is triggered.\nThe impact of this memory corruption is twofold. First, the overflow may cause the application to read out-of-bounds memory, potentially leaking adjacent process memory, which could include sensitive keys, credentials, or session data, back to the attacker or into application logs. Second, the corruption of memory structures adjacent to the buffer typically results in immediate memory access violations, leading to a crash or undefined process behavior, effectively resulting in a denial-of-service state.\nThis vulnerability is particularly dangerous because it does not require authentication or elevated privileges. Any application interface that accepts and processes tensors from external sources, such as remote API endpoints or uploaded model data, serves as a vector for this exploit. The flaw exists specifically in the validation of the tensor structure before it is passed to underlying native or managed memory handlers, meaning the vulnerability remains active regardless of the specific underlying machine learning engine until the input validation logic is patched.\nTo remediate the vulnerability, the internal validation routines must ensure that all calculations related to buffer allocation are subjected to overflow checks, ensuring that inputs do not exceed the capacity of the integer types used for indexing and allocation. Version 0.37.0 includes the necessary corrections to these validation primitives, preventing the erroneous calculation of buffer sizes and mitigating the risk of memory corruption."
}