HdrHistogram CVE-2026-14683

Q: What is the CVSS score of CVE-2026-14683?

CVE-2026-14683 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-41705 LOW

Uncontrolled Resource Consumption (CWE-400)

2026-07-04 cna@vuldb.com

GHSA-xw83-8gp3-pg5q

Denial Of Service Java

1.9

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

1.9 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.3 LOW

Local attack vector and low privileges required to invoke the function; only local availability impact with no scope change, confidentiality, or integrity effects.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 04, 2026 - 23:31 vuln.today

DescriptionCVE.org

A vulnerability was detected in HdrHistogram up to 2.2.2. Affected by this issue is the function org.HdrHistogram.AbstractHistogram.decodeFromCompressedByteBuffer of the file src/main/java/org/HdrHistogram/AbstractHistogram.java. The manipulation of the argument lengthOfCompressedContents results in uncontrolled memory allocation. The attack needs to be approached locally. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Uncontrolled memory allocation in HdrHistogram up to version 2.2.2 allows a local attacker with low-privilege access to crash a dependent Java application by supplying a crafted lengthOfCompressedContents value to the decodeFromCompressedByteBuffer function, exhausting JVM heap space and causing a denial-of-service. A public proof-of-concept exists (E:P per CVSS 4.0), though the vulnerability is not listed in CISA KEV, indicating no confirmed widespread active exploitation. The CVSS 4.0 score of 1.9 reflects the strictly local attack vector and limited impact scope - only availability at the vulnerable system level is affected.

Technical ContextAI

HdrHistogram is a widely embedded Java library for high-dynamic-range histogram recording, commonly used in latency measurement and metrics pipelines within frameworks such as Dropwizard Metrics, Akka, and others. The vulnerable code resides in src/main/java/org/HdrHistogram/AbstractHistogram.java, within the decodeFromCompressedByteBuffer method. This function processes externally-supplied compressed histogram data; the root cause is CWE-400 (Uncontrolled Resource Consumption) - the lengthOfCompressedContents parameter is trusted without upper-bound validation before being used to drive memory allocation. A crafted input can instruct the JVM to attempt an arbitrarily large heap allocation, triggering an OutOfMemoryError and crashing the host application. No CPE string was provided in the input data, but the affected scope is the Java implementation of HdrHistogram through version 2.2.2 as hosted at https://github.com/HdrHistogram/HdrHistogram/.

RemediationAI

No vendor-released patch has been identified at time of analysis - the project maintainer had not responded to the disclosure report, and no fixed release version appears in any reference. Developers should monitor https://github.com/HdrHistogram/HdrHistogram/issues/219 for upstream patch availability. As a primary compensating control, applications that pass externally-supplied or user-influenced data to decodeFromCompressedByteBuffer should validate and enforce an upper bound on the lengthOfCompressedContents value before invocation; rejecting inputs above a reasonable threshold (e.g., configured max histogram size) prevents unbounded allocation at the cost of rejecting malformed or adversarially crafted inputs. Configuring JVM heap limits (-Xmx) and enabling OOM monitoring (e.g., -XX:+HeapDumpOnOutOfMemoryError) can limit blast radius and aid incident detection but do not prevent the vulnerability from being triggered. Applications that only pass internally generated, fully trusted data to this function are not at meaningful risk and require no immediate action.