CVE-2026-103635: Apache DataSketches: datasketches-cpp: Out-of-bounds read in compact Theta sketch deserialization allows denial of service via a crafted sketch
Out-of-bounds read in the compact Theta sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp).
compactthetasketch::deserialize() and wrappedcompactthetasketch::wrap() read header fields before checking that the input was long enough. For the compressed format, the size check could be defeated by a 32-bit overflow, and two header fields that control decoding were not validated; this also affected deserialization from a stream. A crafted or truncated sketch could cause a read past the end of the input. In the compressed case the over-read can be large, and the bytes read can become part of the deserialized sketch. This can cause a crash (denial of service) and could expose adjacent memory contents.
This issue affects Apache DataSketches C++: from 3.1.0 before 5.3.0. Only applications that deserialize Theta sketches from untrusted sources are affected.
Users are recommended to upgrade to version 5.3.0, which fixes this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
datasketches-cppto a version that resolves this vulnerability.Fixed in 5.3.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Only applications that deserialize Theta sketches from untrusted sources are affected. Applications using Apache DataSketches C++ versions from 3.1.0 before 5.3.0 are within the affected version range.
What does an attacker need to provide to trigger the vulnerability?
An attacker needs to supply a crafted or truncated compact Theta sketch to an application that deserializes untrusted sketches. The affected paths include compact_theta_sketch::deserialize(), wrapped_compact_theta_sketch::wrap(), and deserialization from a stream.
What is the impact of a successful exploit?
Malformed input can cause an out-of-bounds read that crashes the application, resulting in denial of service. For compressed sketches, the over-read may be large and adjacent memory bytes may become part of the deserialized sketch, potentially exposing memory contents.
What should teams do to remediate the issue?
Upgrade Apache DataSketches C++ to version 5.3.0. This release fixes the insufficient input-length checks, the compressed-format size-check overflow condition, and validation of the relevant decoding header fields.