CVE-2026-14686
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
A vulnerability was found in HdrHistogram up to version 2.2.2 in the `DoubleHistogram.recordValue` function. It involves an incorrect comparison during range checking, potentially leading to erroneous behavior. The attack requires local access and is publicly known, but its significance is disputed due to security boundary limitations.
Risk Assessment
The risk to the organization is low as the attack requires local access and does not cross security boundaries. However, it may cause incorrect behavior in applications using this library.
Recommendation
It is recommended to update HdrHistogram to the latest version if available and monitor public disclosures. If no update is available, restricting local access to the system can mitigate the risk.
Other vulnerabilities in HdrHistogram
See all- CVE-2026-14685Low
A vulnerability was found in HdrHistogram up to version 2.2.2 in the recordValueWithCount method of the AbstractHistogram class. Manipulation of the Count argument leads to a state issue. The attack requires local access and has been publicly disclosed, but its existence is disputed due to lack of security boundary crossing.
- CVE-2026-14684Low
A flaw has been found in HdrHistogram up to version 2.2.2, involving uncontrolled memory allocation in the decodeFromByteBuffer function when processing the numberOfSignificantValueDigits argument. The attack requires local access and an exploit has been published, but the vulnerability is disputed due to potential lack of security boundary crossing.
- CVE-2026-14683Low
A vulnerability was found in HdrHistogram up to version 2.2.2, involving uncontrolled memory allocation in the decodeFromCompressedByteBuffer function. The attack requires local access and manipulation of the lengthOfCompressedContents argument. The existence of the vulnerability is disputed due to doubts about crossing security boundaries.
Original NVD description (English source)
A vulnerability was found in HdrHistogram up to 2.2.2. This issue affects the function org.HdrHistogram.DoubleHistogram.recordValue of the file src/main/java/org/HdrHistogram/DoubleHistogram.java of the component Range Check. Performing a manipulation results in incorrect comparison. The attack is only possible with local access. The exploit has been made public and could be used. The presence of this vulnerability remains uncertain at this time. This issue is disputed due to the potential lack of crossing of security boundaries and the pre-requisites for a successful attack.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS