CVE-2026-14686
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
A vulnerability was found in HdrHistogram up to version 2.2.2 in the `DoubleHistogram.recordValue` function. It involves an incorrect comparison during range checking, potentially leading to erroneous behavior. The attack requires local access and is publicly known, but its significance is disputed due to security boundary limitations.
Risk Assessment
The risk to the organization is low as the attack requires local access and does not cross security boundaries. However, it may cause incorrect behavior in applications using this library.
Recommendation
It is recommended to update HdrHistogram to the latest version if available and monitor public disclosures. If no update is available, restricting local access to the system can mitigate the risk.
Original NVD description (English source)
A vulnerability was found in HdrHistogram up to 2.2.2. This issue affects the function org.HdrHistogram.DoubleHistogram.recordValue of the file src/main/java/org/HdrHistogram/DoubleHistogram.java of the component Range Check. Performing a manipulation results in incorrect comparison. The attack is only possible with local access. The exploit has been made public and could be used. The presence of this vulnerability remains uncertain at this time. This issue is disputed due to the potential lack of crossing of security boundaries and the pre-requisites for a successful attack.