GHSA-jghc-rj2j-x37xunknown
Uncontrolled Resource Consumption vulnerability in the sketch deserialization of Apache...
🔗 CVE IDs covered (1)
📋 Description
Uncontrolled Resource Consumption vulnerability in the sketch deserialization of Apache DataSketches Java.
Several deserializers trusted sizes and counts declared in the serialized input. A small crafted input could make an application allocate an excessive amount of memory, leading to an OutOfMemoryError. A crafted string passed to FrequentLongsSketch.getInstance(String) could also make deserialization, or a later update, loop indefinitely. Only applications that deserialize sketches from untrusted sources are affected.
This issue affects Apache DataSketches Java: through 9.0.0.
Users are recommended to upgrade to version 9.1.0, which fixes the issue.
🔗 References (7)
- https://nvd.nist.gov/vuln/detail/CVE-2026-122096
- https://github.com/apache/datasketches-java/pull/777
- https://github.com/apache/datasketches-java/pull/783
- https://github.com/apache/datasketches-java/releases/tag/9.1.0
- https://lists.apache.org/thread/9wd7ngmho7hm8x74sq1p2fp1xgjd8kt6
- http://www.openwall.com/lists/oss-security/2026/11/10/29
- https://github.com/advisories/GHSA-jghc-rj2j-x37x