PT-2026-55742

CVE-2026-14684

Published

2026-07-04

Updated

2026-10-31

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HdrHistogram versions prior to 2.2.3

Description A flaw exists in the decodeFromByteBuffer() function within the org.HdrHistogram.AbstractHistogram class. This issue occurs when the numberOfSignificantValueDigits argument is manipulated, leading to uncontrolled memory allocation. This attack can only be executed locally.

Recommendations Update HdrHistogram to a version newer than 2.2.2. As a temporary workaround, restrict the use of the decodeFromByteBuffer() function to prevent uncontrolled memory allocation.

Exploitability

Exploit

Fix

Impacts

Researchers

Sara11H

Vendors

Affected products

Weakness enumeration

CWE-400: Uncontrolled Resource Consumption

CWE-789: Memory Allocation with Excessive Size Value

Related identifiers