CVE-2026-87962 Details
Description
t-digest versions 3.1 through 3.3 contain a denial of service vulnerability in MergingDigest.fromBytes that fails to validate length and capacity fields from serialized data. Attackers can supply crafted serialized digests with mismatched header fields to trigger ArrayIndexOutOfBoundsException or NegativeArraySizeException, aborting the parsing thread.
A denial-of-service vulnerability has been identified in t-digest versions 3.1 through 3.3. The issue arises in the method MergingDigest.fromBytes, which fails to properly validate length and capacity fields in serialized data. This oversight allows attackers to send crafted serialized digests with inconsistent header fields, leading to ArrayIndexOutOfBoundsException or NegativeArraySizeException. As a result, the parsing thread is aborted.
Users are advised to update to t-digest version 3.3, which includes a validation step for the deserialization process. After updating, it is recommended to re-serialize and byte-for-byte validate any t-digest digests before deserializing them to ensure they are not malformed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 10, 2026CISA-ADP
Assessed Sep 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/tdunning/t-digest/issues/227 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/tdunning/t-digest | [email protected] | Source CodeVendor |
| https://github.com/tdunning/t-digest/blob/7905f3d2ad18e7d7176811147d1316a3e23d7061/core/src/main/java/com/tdunning/math/stats/MergingDigest.java | [email protected] | Source CodeVendor |
| https://github.com/tdunning/t-digest/issues/227 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/t-digest-3.1-through-3.3-denial-of-service-via-unvalidated-length-fields-in-mergingdigest-frombytes | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1284 | Improper Validation of Specified Quantity in Input | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| t-digest | >= 3.1, <= 3.3 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 10, 2026 | CVE Modified | CISA-ADP |
| Sep 10, 2026 | New CVE Received | [email protected] |