CVE-2026-103635

Name of the Vulnerable Software and Affected Versions Apache DataSketches C++ versions 3.1.0 through 5.2.9

Description An out-of-bounds read exists during the deserialization of compact Theta sketches. The functions compact theta sketch::deserialize() and wrapped compact theta sketch::wrap() read header fields without verifying if the input length is sufficient. In the compressed format, a 32-bit overflow can bypass size checks, and two header fields controlling decoding are not validated, which also impacts stream deserialization. A crafted or truncated sketch can trigger a read past the end of the input, potentially causing a crash (denial of service) or exposing adjacent memory contents. This issue specifically affects applications that deserialize Theta sketches from untrusted sources.

Recommendations Upgrade to version 5.3.0.