PT-2026-145161

CVE-2026-122096

Published

2026-11-11

Updated

2026-11-11

Description by

Score

N/A

Not available

No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.

Uncontrolled Resource Consumption vulnerability in the sketch deserialization of Apache DataSketches Java.

Several deserializers trusted sizes and counts declared in the serialized input. A small crafted input could make an application allocate an excessive amount of memory, leading to an OutOfMemoryError. A crafted string passed to FrequentLongsSketch.getInstance(String) could also make deserialization, or a later update, loop indefinitely. Only applications that deserialize sketches from untrusted sources are affected.

This issue affects Apache DataSketches Java: through 9.0.0.

Users are recommended to upgrade to version 9.1.0, which fixes the issue.

Impacts

Researchers

Jaideep Pyne

Vendors

Affected products

Weakness enumeration

CWE-400: Uncontrolled Resource Consumption

CWE-835: Loop with Unreachable Exit Condition (\'Infinite Loop\')

CWE-789: Memory Allocation with Excessive Size Value

Related identifiers