CVE-2026-87822: t-digest 3.1 through 3.3 Denial of Service via NaN Centroid Means in MergingDigest.fromBytes
t-digest versions 3.1 through 3.3 fail to validate centroid means during deserialization in MergingDigest.fromBytes, allowing attackers to inject NaN values that bypass validation checks. Attackers can craft malicious serialized digests containing NaN centroids that degrade sorting performance from O(n log n) to O(n squared), causing severe processing delays during merge operations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
t-digestto a version that resolves this vulnerability.Fixed in 3.1 through 3.3
Event History
Frequently Asked Questions
What conditions are required to exploit this issue?
An attacker needs to cause the application to deserialize a crafted serialized t-digest through MergingDigest.fromBytes and later process it in a merge operation. The malicious digest must contain centroid means set to NaN.
Which deployments are exposed?
Deployments using t-digest versions 3.1 through 3.3 are exposed if they accept serialized digest data that an attacker can influence or supply. The issue affects deserialization in MergingDigest.fromBytes rather than ordinary digest processing alone.
What is the operational impact of a malicious digest?
NaN centroid means bypass validation and can cause sorting performance during merge operations to degrade from O(n log n) to O(n squared). This can create severe processing delays and result in denial of service.