Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-87962

t-digest 3.1 through 3.3 Denial of Service via Unvalidated Length Fields in MergingDigest.fromBytes

t-digest versions 3.1 through 3.3 contain a denial of service vulnerability in MergingDigest.fromBytes that fails to validate length and capacity fields from serialized data. Attackers can supply crafted serialized digests with mismatched header fields to trigger ArrayIndexOutOfBoundsException or NegativeArraySizeException, aborting the parsing thread.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Tdunning
Products
T-digest
CVE-2026-87822

t-digest 3.1 through 3.3 Denial of Service via NaN Centroid Means in MergingDigest.fromBytes

t-digest versions 3.1 through 3.3 fail to validate centroid means during deserialization in MergingDigest.fromBytes, allowing attackers to inject NaN values that bypass validation checks. Attackers can craft malicious serialized digests containing NaN centroids that degrade sorting performance from O(n log n) to O(n squared), causing severe processing delays during merge operations.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Tdunning
Products
T-digest