CVE-2026-14683
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
A vulnerability was found in HdrHistogram up to version 2.2.2, involving uncontrolled memory allocation in the decodeFromCompressedByteBuffer function. The attack requires local access and manipulation of the lengthOfCompressedContents argument. The existence of the vulnerability is disputed due to doubts about crossing security boundaries.
Risk Assessment
The risk for the organization is potential memory exhaustion by a local attacker, which could lead to denial of service (DoS) in applications using HdrHistogram. However, due to the disputed nature of the vulnerability, the risk is considered low.
Recommendation
It is recommended to update HdrHistogram to the latest version if available and monitor public disclosures. If no update is available, restricting local access to the system may mitigate the risk.
Original NVD description (English source)
A vulnerability was detected in HdrHistogram up to 2.2.2. Affected by this issue is the function org.HdrHistogram.AbstractHistogram.decodeFromCompressedByteBuffer of the file src/main/java/org/HdrHistogram/AbstractHistogram.java. The manipulation of the argument lengthOfCompressedContents results in uncontrolled memory allocation. The attack needs to be approached locally. The exploit is now public and may be used. It is still unclear if this vulnerability genuinely exists. This issue is disputed due to the potential lack of crossing of security boundaries and the pre-requisites for a successful attack.