Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

ai.djl:api

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.3MavenPublished

    Deep Java Library path traversal issue

    CVE-2025-0851 · GHSA-jcrp-x7w3-ffmg

    Affected
    • Maven ai.djl:api < 0.31.1
    Fixed in
    0.31.1· Vendor fix available
    Issue
    Deep Java Library (DJL) is an open-source, high-level, engine-agnostic Java framework for deep learning. DJL is designed to be easy to get started with and simple to use for Java developers. DJL provides a native Java development experience and functions like any other regular Java library. DJL provides utilities for extracting tar and zip model archives that are used when loading models for use with DJL. These utilities were found to contain issues that do not protect against absolute path traversal during the extraction process. Impact An issue exists with DJL's untar and unzip functionalities. Specifically, it is possible to create an archive on a Windows system, and when extracted on a MacOS or Linux system, write artifacts outside the intended destination during the extraction process. The reverse is also true for archives created on MacOS/Linux systems and extracted on Windows systems. Impacted versions: 0.1.0 - 0.31.0 Patches This issue has been patched in DJL 0.31.1…

    Recommended action: Upgrade to 0.31.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. Critical, CVSS 10.0MavenPublished

    DeepJavaLibrary API absolute path traversal

    CVE-2024-37902 · GHSA-w877-jfw7-46rj

    Affected
    • Maven ai.djl:api >= 0.1.0, < 0.28.0
    Fixed in
    0.28.0· Vendor fix available
    Issue
    DeepJavaLibrary(DJL) versions 0.1.0 through 0.27.0 do not prevent absolute path archived artifacts from inserting archived files directly into the system, overwriting system files. This is fixed in DJL 0.28.0 and patched in DJL Large Model Inference containers 0.27.0. Impacted versions: 0.1.0 through 0.27.0 Patches Patched Deep Learning Containers: v1.1-djl-0.27.0-inf-cpu-full v1.4-djl-0.27.0-inf-ds-0.12.6 v1.4-djl-0.27.0-inf-trt-0.8.0 v1.3-djl-0.27.0-inf-neuronx-sdk2.18.1 Patched Library: v0.28.0

    Recommended action: Upgrade to 0.28.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →