CVE-2026-14685
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
A vulnerability was found in HdrHistogram up to version 2.2.2 in the recordValueWithCount method of the AbstractHistogram class. Manipulation of the Count argument leads to a state issue. The attack requires local access and has been publicly disclosed, but its existence is disputed due to lack of security boundary crossing.
Risk Assessment
The risk to the organization is low as the attack requires local access and is disputed. However, it may cause unexpected application behavior in environments using the vulnerable library version.
Recommendation
It is recommended to update HdrHistogram to the latest version if available, or apply a patch. Monitor official vendor communications for further fixes.
Original NVD description (English source)
A vulnerability has been found in HdrHistogram up to 2.2.2. This vulnerability affects the function recordValueWithCount of the file src/main/java/org/HdrHistogram/AbstractHistogram.java of the component AbstractHistogram. Such manipulation of the argument Count leads to state issue. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. The existence of this vulnerability is still disputed at present. This issue is disputed due to the potential lack of crossing of security boundaries and the pre-requisites for a successful attack.