CVE-2026-14684
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
A flaw has been found in HdrHistogram up to version 2.2.2, involving uncontrolled memory allocation in the decodeFromByteBuffer function when processing the numberOfSignificantValueDigits argument. The attack requires local access and an exploit has been published, but the vulnerability is disputed due to potential lack of security boundary crossing.
Risk Assessment
The risk to the organization is limited as the attack requires local access and the vulnerability is disputed. If confirmed, it could lead to memory exhaustion and potential denial of service in applications using this library.
Recommendation
It is recommended to update HdrHistogram to the latest available version and monitor official communications for confirmation of the vulnerability. In the meantime, restrict local access to systems using this library.
Original NVD description (English source)
A flaw has been found in HdrHistogram up to 2.2.2. This affects the function org.HdrHistogram.AbstractHistogram.decodeFromByteBuffer of the file src/main/java/org/HdrHistogram/AbstractHistogram.java. This manipulation of the argument numberOfSignificantValueDigits causes uncontrolled memory allocation. The attack can only be executed locally. The exploit has been published and may be used. The actual existence of this vulnerability is currently in question. This issue is disputed due to the potential lack of crossing of security boundaries and the pre-requisites for a successful attack.