CVE-2026-87962: t-digest 3.1 through 3.3 Denial of Service via Unvalidated Length Fields in MergingDigest.fromBytes
t-digest versions 3.1 through 3.3 contain a denial of service vulnerability in MergingDigest.fromBytes that fails to validate length and capacity fields from serialized data. Attackers can supply crafted serialized digests with mismatched header fields to trigger ArrayIndexOutOfBoundsException or NegativeArraySizeException, aborting the parsing thread.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
t-digestto a version that resolves this vulnerability.Fixed in 3.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using t-digest 3.1 through 3.3 are exposed if they pass attacker-controlled serialized digest data to MergingDigest.fromBytes. The issue can be triggered remotely without authentication or user interaction where such input is reachable over the network.
What does an attacker need to do to trigger the denial of service?
An attacker needs to provide a crafted serialized digest with mismatched length or capacity header fields. Processing that data can cause ArrayIndexOutOfBoundsException or NegativeArraySizeException and abort the parsing thread.
How can I determine whether my application is affected?
Check whether it uses t-digest versions 3.1, 3.2, or 3.3 and invokes MergingDigest.fromBytes on serialized data from untrusted sources. Parsing failures involving ArrayIndexOutOfBoundsException or NegativeArraySizeException may indicate attempted exploitation or exposure.