CVE-2026-87962

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-87962", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-09-09T17:35:22.800Z", "datePublished": "2026-09-10T10:52:38.047Z", "dateUpdated": "2026-09-10T12:56:58.192Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-09-10T10:52:38.047Z"}, "datePublic": "2026-08-14T00:00:00.000Z", "title": "t-digest 3.1 through 3.3 Denial of Service via Unvalidated Length Fields in MergingDigest.fromBytes", "descriptions": [{"lang": "en", "value": "t-digest versions 3.1 through 3.3 contain a denial of service vulnerability in MergingDigest.fromBytes that fails to validate length and capacity fields from serialized data. Attackers can supply crafted serialized digests with mismatched header fields to trigger ArrayIndexOutOfBoundsException or NegativeArraySizeException, aborting the parsing thread."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Validation of Specified Quantity in Input", "cweId": "CWE-1284", "type": "CWE"}]}], "affected": [{"vendor": "tdunning", "product": "t-digest", "collectionURL": "https://repo1.maven.org/maven2/com/tdunning/t-digest/", "repo": "https://github.com/tdunning/t-digest", "defaultStatus": "unaffected", "packageURL": "pkg:maven/com.tdunning/t-digest", "versions": [{"version": "3.1", "lessThanOrEqual": "3.3", "status": "affected", "versionType": "custom"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/tdunning/t-digest/issues/227", "tags": ["issue-tracking"], "name": "GitHub Issue #227"}, {"url": "https://github.com/tdunning/t-digest/blob/7905f3d2ad18e7d7176811147d1316a3e23d7061/core/src/main/java/com/tdunning/math/stats/MergingDigest.java", "tags": ["technical-description"], "name": "MergingDigest.java"}, {"url": "https://github.com/tdunning/t-digest", "tags": ["product"]}, {"name": "VulnCheck Advisory: t-digest 3.1 through 3.3 Denial of Service via Unvalidated Length Fields in MergingDigest.fromBytes", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/t-digest-3.1-through-3.3-denial-of-service-via-unvalidated-length-fields-in-mergingdigest-frombytes"}], "credits": [{"lang": "en", "value": "Yu Bao, PayPal Cyber Security Team", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"references": [{"url": "https://github.com/tdunning/t-digest/issues/227", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-10T12:56:34.629972Z", "id": "CVE-2026-87962", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-10T12:56:58.192Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-87962", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-10T12:56:34.629972Z"}}}], "references": [{"url": "https://github.com/tdunning/t-digest/issues/227", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-10T12:56:52.524Z"}}], "cna": {"title": "t-digest 3.1 through 3.3 Denial of Service via Unvalidated Length Fields in MergingDigest.fromBytes", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Yu Bao, PayPal Cyber Security Team"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"repo": "https://github.com/tdunning/t-digest", "vendor": "tdunning", "product": "t-digest", "versions": [{"status": "affected", "version": "3.1", "versionType": "custom", "lessThanOrEqual": "3.3"}], "packageURL": "pkg:maven/com.tdunning/t-digest", "collectionURL": "https://repo1.maven.org/maven2/com/tdunning/t-digest/", "defaultStatus": "unaffected"}], "datePublic": "2026-08-14T00:00:00.000Z", "references": [{"url": "https://github.com/tdunning/t-digest/issues/227", "name": "GitHub Issue #227", "tags": ["issue-tracking"]}, {"url": "https://github.com/tdunning/t-digest/blob/7905f3d2ad18e7d7176811147d1316a3e23d7061/core/src/main/java/com/tdunning/math/stats/MergingDigest.java", "name": "MergingDigest.java", "tags": ["technical-description"]}, {"url": "https://github.com/tdunning/t-digest", "tags": ["product"]}, {"url": "https://www.vulncheck.com/advisories/t-digest-3.1-through-3.3-denial-of-service-via-unvalidated-length-fields-in-mergingdigest-frombytes", "name": "VulnCheck Advisory: t-digest 3.1 through 3.3 Denial of Service via Unvalidated Length Fields in MergingDigest.fromBytes", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "t-digest versions 3.1 through 3.3 contain a denial of service vulnerability in MergingDigest.fromBytes that fails to validate length and capacity fields from serialized data. Attackers can supply crafted serialized digests with mismatched header fields to trigger ArrayIndexOutOfBoundsException or NegativeArraySizeException, aborting the parsing thread."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1284", "description": "Improper Validation of Specified Quantity in Input"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-09-10T10:52:38.047Z"}}}, "cveMetadata": {"cveId": "CVE-2026-87962", "state": "PUBLISHED", "dateUpdated": "2026-09-10T12:56:58.192Z", "dateReserved": "2026-09-09T17:35:22.800Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-09-10T10:52:38.047Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo1.maven.org/maven2/com/tdunning/t-digest/", "defaultStatus": "unaffected", "packageURL": "pkg:maven/com.tdunning/t-digest", "product": "t-digest", "repo": "https://github.com/tdunning/t-digest", "vendor": "tdunning", "versions": [{"lessThanOrEqual": "3.3", "status": "affected", "version": "3.1", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "t-digest versions 3.1 through 3.3 contain a denial of service vulnerability in MergingDigest.fromBytes that fails to validate length and capacity fields from serialized data. Attackers can supply crafted serialized digests with mismatched header fields to trigger ArrayIndexOutOfBoundsException or NegativeArraySizeException, aborting the parsing thread."}], "id": "CVE-2026-87962", "lastModified": "2026-09-10T15:53:23.707", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-87962", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-10T12:56:34.629972Z", "version": "2.0.3"}}]}, "published": "2026-09-10T11:17:07.763", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/tdunning/t-digest"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/tdunning/t-digest/blob/7905f3d2ad18e7d7176811147d1316a3e23d7061/core/src/main/java/com/tdunning/math/stats/MergingDigest.java"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/tdunning/t-digest/issues/227"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/t-digest-3.1-through-3.3-denial-of-service-via-unvalidated-length-fields-in-mergingdigest-frombytes"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/tdunning/t-digest/issues/227"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1284"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "com.tdunning/t-digest: t-digest: t-digest: Denial of Service via unvalidated length fields", "id": "2531399", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531399"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["A flaw was found in t-digest. A remote attacker could exploit a denial of service vulnerability in the `MergingDigest.fromBytes` function by providing specially crafted serialized data. This data, with unvalidated length and capacity fields, can cause the parsing thread to abort due to an `ArrayIndexOutOfBoundsException` or `NegativeArraySizeException`, leading to a denial of service."], "mitigation": {"lang": "en:us", "value": "Apply the upstream fix.\nAs a workaround, ensure that t-digest serialized data is only accepted from trusted sources and not exposed to untrusted network input."}, "name": "CVE-2026-87962", "package_state": [{"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Affected", "package_name": "t-digest", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:offline_knowledge_portal:1", "fix_state": "Affected", "package_name": "offline-knowledge-portal/rhokp-rhel9", "product_name": "Red Hat Offline Knowledge Portal"}], "public_date": "2026-09-10T10:52:38Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-87962\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-87962\nhttps://github.com/tdunning/t-digest\nhttps://github.com/tdunning/t-digest/blob/7905f3d2ad18e7d7176811147d1316a3e23d7061/core/src/main/java/com/tdunning/math/stats/MergingDigest.java\nhttps://github.com/tdunning/t-digest/issues/227\nhttps://www.vulncheck.com/advisories/t-digest-3.1-through-3.3-denial-of-service-via-unvalidated-length-fields-in-mergingdigest-frombytes"], "statement": "The MergingDigest.fromBytes() method does not validate length fields in serialized input, allowing an attacker to cause excessive memory allocation or out-of-bounds reads, resulting in a Denial of Service. This is exploitable when deserializing untrusted t-digest data received over the network.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[3.1,3.3]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "t-digest", "source": "cna", "vendor": "tdunning"}, "product": "t-digest", "vendor": "tdunning"}], "created": "2026-09-10T14:00:10.720127+00:00", "updated": "2026-09-11T07:30:09.882568+00:00", "vendors": ["tdunning", "tdunning$PRODUCT$t-digest"]}