CVE-2026-87962 in t-digest
Summary
by MITRE • 09/10/2026
t-digest versions 3.1 through 3.3 contain a denial of service vulnerability in MergingDigest.fromBytes that fails to validate length and capacity fields from serialized data. Attackers can supply crafted serialized digests with mismatched header fields to trigger ArrayIndexOutOfBoundsException or NegativeArraySizeException, aborting the parsing thread.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/10/2026
The t-digest library is a widely used statistical tool for computing approximate distribution statistics such as quantiles and percentiles from streaming data. Versions 3.1 through 3.3 of this library contain a critical security flaw within the MergingDigest.fromBytes method, which is responsible for deserializing previously saved or transmitted digest objects back into memory for further processing. This vulnerability stems directly from CWE-20 Improper Input Validation and falls under the ATT&CK technique T1496 Resource Hijacking via Denial of Service. The core issue lies in the failure to adequately validate the length and capacity fields contained within the serialized data structure before attempting to allocate memory or access array indices based on these values.
When an attacker supplies a crafted, maliciously constructed serialized digest, they can manipulate the header fields that specify the expected size and capacity of the internal arrays used by the t-digest implementation. Because the deserialization process trusts these metadata fields without rigorous boundary checks, it proceeds to allocate memory or access array elements based on potentially invalid values. If the specified length exceeds available resources or is negative, the Java Virtual Machine throws an ArrayIndexOutOfBoundsException or a NegativeArraySizeException respectively. These unhandled exceptions cause the thread responsible for parsing and processing the digest to terminate abruptly.
The operational impact of this vulnerability is significant in environments where t-digest is used within high-throughput streaming pipelines or web services that accept user-supplied serialized data. An attacker can exploit this flaw to trigger a denial of service condition by repeatedly sending malformed payloads, causing application threads to crash and restart. This not only disrupts the availability of statistical computations but also consumes system resources through repeated thread creation and garbage collection cycles associated with exception handling. In distributed systems relying on t-digest for real-time analytics, such instability can lead to data loss or degraded performance across multiple nodes if the vulnerability is triggered frequently enough.
Mitigation strategies must focus on immediate patching and defensive coding practices. Organizations should upgrade to a version of t-digest that includes proper input validation logic within the deserialization routines, ensuring that all length and capacity fields are checked against reasonable bounds before memory allocation occurs. For systems unable to update immediately, implementing strict serialization filters or allowing lists in Java’s ObjectInputStream can prevent the execution of untrusted code paths associated with this vulnerability. Additionally, deploying network-level intrusion detection signatures capable of identifying anomalous serialized data patterns may help mitigate exploitation attempts until a permanent fix is applied.