CVE-2026-87962CWE-1284

CVE-2026-87962

High · published September 10, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
49.5
In the wild
Unconfirmed
What it is

t-digest versions 3.1 through 3.3 contain a denial of service vulnerability in MergingDigest.fromBytes that fails to validate length and capacity fields from serialized data. Attackers can supply crafted serialized digests with mismatched header fields to trigger ArrayIndexOutOfBoundsException or NegativeArraySizeException, aborting the parsing thread.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00630 · 49.5th percentile
Weakness
CWE-1284 · Improper Validation of Specified Quantity in Input
Published
2026-09-10T15:17Z
References (5)
https://github.com/tdunning/t-digest · [email protected]https://github.com/tdunning/t-digest/blob/7905f3d2ad18e7d7176811147d1316a3e23d7061/core/src/main/java/com/tdunning/math/stats/MergingDigest.java · [email protected]https://github.com/tdunning/t-digest/issues/227 · [email protected]https://www.vulncheck.com/advisories/t-digest-3.1-through-3.3-denial-of-service-via-unvalidated-length-fields-in-mergingdigest-frombytes · [email protected]https://github.com/tdunning/t-digest/issues/227 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 12 SEP 03:22Z
    EPSS moved — → 0%
    epss
  • 10 SEP 10:52Z
    t-digest 3.1 through 3.3 Denial of Service via Unvalidated Length Fields in MergingDigest.fromBytes
    cvelistv5