CVE-2026-87822
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
t-digest versions 3.1 through 3.3 fail to validate centroid means during deserialization in MergingDigest.fromBytes, allowing attackers to inject NaN values that bypass validation checks. Attackers can craft malicious serialized digests containing NaN centroids that degrade sorting performance from O(n log n) to O(n squared), causing severe processing delays during merge operations.
Risk Assessment
This vulnerability can lead to significant application slowdowns (DoS) by forcing quadratic complexity during data processing.
Recommendation
Upgrade t-digest to a version later than 3.3, which includes the centroid validation fix.
Other vulnerabilities in t-digest
Original NVD description (English source)
t-digest versions 3.1 through 3.3 fail to validate centroid means during deserialization in MergingDigest.fromBytes, allowing attackers to inject NaN values that bypass validation checks. Attackers can craft malicious serialized digests containing NaN centroids that degrade sorting performance from O(n log n) to O(n squared), causing severe processing delays during merge operations.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS