CVE-2026-87822 in t-digest
Summary
by MITRE • 09/09/2026
t-digest versions 3.1 through 3.3 fail to validate centroid means during deserialization in MergingDigest.fromBytes, allowing attackers to inject NaN values that bypass validation checks. Attackers can craft malicious serialized digests containing NaN centroids that degrade sorting performance from O(n log n) to O(n squared), causing severe processing delays during merge operations.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified in t-digest versions 3.1 through 3.3 represents a critical failure in input validation within the deserialization process, specifically affecting the MergingDigest.fromBytes method. This flaw stems from an insufficient check on centroid means when reconstructing digest objects from serialized byte streams. In normal operation, these centroids represent statistical summaries of data distributions and are expected to hold valid numerical values that maintain mathematical integrity during merge operations. However, due to the lack of rigorous validation logic, attackers can inject Not-a-Number (NaN) values directly into the centroid fields without triggering any error conditions or rejection mechanisms. This oversight allows maliciously crafted serialized digests to be accepted by the system as legitimate data structures, effectively bypassing standard security controls designed to ensure data integrity and consistency during object reconstruction.
The operational impact of this vulnerability is severe, primarily manifesting as a denial-of-service condition through resource exhaustion rather than traditional code execution or information disclosure. When a t-digest containing NaN centroids undergoes merge operations with other digests, the presence of these invalid values disrupts standard sorting algorithms that rely on comparative ordering. Specifically, the inclusion of NaN values causes comparison functions to behave unpredictably, often resulting in infinite loops or excessive comparisons as the algorithm attempts to resolve undefined relationships between data points. This degradation transforms the expected time complexity of sorting operations from O(n log n) to O(n squared), leading to significant processing delays and potential system unavailability under load. The performance hit is not merely a minor latency issue but can effectively freeze services that depend on real-time statistical aggregation, thereby impacting availability and reliability for downstream applications relying on accurate percentile calculations.
From a security classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation, as the system fails to verify that deserialized data meets expected constraints before processing. Additionally, it relates to CWE-400 Uncontrolled Resource Consumption because the malicious input directly leads to excessive CPU usage and time complexity escalation. In terms of adversary tactics, this technique corresponds to ATT&CK T1496 Resource Hijacking, where attackers leverage system resources for disruptive purposes rather than data theft or persistence. The attack vector typically involves supplying a crafted serialized object through any interface that accepts t-digest inputs, such as API endpoints, message queues, or file uploads that process statistical summaries.
Mitigation strategies must focus on both immediate patching and long-term architectural improvements. Organizations running affected versions should immediately upgrade to patched releases where the deserialization logic has been hardened to explicitly reject NaN values during centroid validation. For systems unable to update promptly, input sanitization layers can be implemented at network or application boundaries to filter out malformed serialized payloads before they reach the t-digest processing engine. Developers should also consider implementing strict type checking and range validation for all numerical fields in deserialization routines to prevent similar issues across other components. Furthermore, integrating automated testing with fuzzing tools that specifically target serialization endpoints can help identify such validation gaps early in the development lifecycle, ensuring robustness against malformed inputs that exploit edge cases in mathematical libraries.