CVE-2026-87962

HighCVSS 7.5

Published: 10/09/2026(UTC)Updated: 10/09/2026(UTC)Translated: 10/09/2026(UTC)NVD NIST

Summary

t-digest versions 3.1 through 3.3 contain a denial of service vulnerability in MergingDigest.fromBytes that fails to validate length and capacity fields from serialized data. Attackers can supply crafted serialized digests with mismatched header fields to trigger ArrayIndexOutOfBoundsException or NegativeArraySizeException, aborting the parsing thread.

Risk Assessment

An attacker can remotely trigger an exception and abort processing, causing a denial of service in applications using t-digest. This can disrupt analytics or monitoring systems.

Recommendation

Update the t-digest library to a version containing the fix for length and capacity field validation. Until patched, consider validating or restricting the acceptance of untrusted serialized data.

Other vulnerabilities in t-digest

CVE-2026-87822High
t-digest versions 3.1 through 3.3 fail to validate centroid means during deserialization in MergingDigest.fromBytes, allowing attackers to inject NaN values that bypass validation checks. Attackers can craft malicious serialized digests containing NaN centroids that degrade sorting performance from O(n log n) to O(n squared), causing severe processing delays during merge operations.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS