Sara11H

**Name of the Vulnerable Software and Affected Versions** HdrHistogram versions prior to 2.2.3 **Description** A range check issue exists in the `recordValue()` function within the `org.HdrHistogram.DoubleHistogram` class. A manipulation of this function leads to an incorrect comparison. This issue requires local access to be exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HdrHistogram versions prior to 2.2.3 **Description** An issue exists in the `decodeFromCompressedByteBuffer()` function within the `org.HdrHistogram.AbstractHistogram` class. Local manipulation of the `lengthOfCompressedContents` argument can lead to uncontrolled memory allocation. **Recommendations** Update HdrHistogram to a version newer than 2.2.2. As a temporary mitigation, restrict local access to the `decodeFromCompressedByteBuffer()` function.

**Name of the Vulnerable Software and Affected Versions** HdrHistogram versions prior to 2.2.3 **Description** A flaw exists in the `decodeFromByteBuffer()` function within the `org.HdrHistogram.AbstractHistogram` class. This issue occurs when the `numberOfSignificantValueDigits` argument is manipulated, leading to uncontrolled memory allocation. This attack can only be executed locally. **Recommendations** Update HdrHistogram to a version newer than 2.2.2. As a temporary workaround, restrict the use of the `decodeFromByteBuffer()` function to prevent uncontrolled memory allocation.

**Name of the Vulnerable Software and Affected Versions** HdrHistogram versions prior to 2.2.3 **Description** A state issue exists within the `AbstractHistogram` component. The problem occurs in the `recordValueWithCount()` function located in the `src/main/java/org/HdrHistogram/AbstractHistogram.java` file. Manipulation of the `Count` argument can trigger this issue, though the attack is limited to local environments. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict the use of the `recordValueWithCount()` function to minimize the risk of exploitation.