HdrHistogram CVE-2026-14684

Q: What is the CVSS score of CVE-2026-14684?

CVE-2026-14684 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-41706 LOW

Uncontrolled Resource Consumption (CWE-400)

2026-07-05 cna@vuldb.com

GHSA-5846-q349-47qp

Denial Of Service Java

1.9

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

1.9 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.3 LOW

Local-only library method requiring low-privilege access to supply a crafted buffer; impact is limited to availability of the consuming application only.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 00:27 vuln.today

DescriptionCVE.org

A flaw has been found in HdrHistogram up to 2.2.2. This affects the function org.HdrHistogram.AbstractHistogram.decodeFromByteBuffer of the file src/main/java/org/HdrHistogram/AbstractHistogram.java. This manipulation of the argument numberOfSignificantValueDigits causes uncontrolled memory allocation. The attack can only be executed locally. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Uncontrolled memory allocation in HdrHistogram versions up to 2.2.2 allows a local low-privileged attacker to cause denial of service by passing a crafted byte buffer to the AbstractHistogram.decodeFromByteBuffer method with a malicious numberOfSignificantValueDigits value. The affected Java library fails to validate this argument before using it to drive heap allocation, allowing JVM memory exhaustion in any application that processes attacker-influenced histogram data. Publicly available exploit code exists; no patch has been released as the project maintainer has not responded to the coordinated disclosure.

Technical ContextAI

HdrHistogram is a Java library for recording high dynamic range histogram data, widely embedded in performance monitoring, latency measurement, and observability tooling. The vulnerable method org.HdrHistogram.AbstractHistogram.decodeFromByteBuffer in src/main/java/org/HdrHistogram/AbstractHistogram.java reads histogram data from a ByteBuffer and uses the deserialized numberOfSignificantValueDigits field to size internal data structures. CWE-400 (Uncontrolled Resource Consumption) identifies the root cause: the method performs no bounds validation on this argument before allocating memory proportional to its value, permitting a crafted input to cause arbitrarily large heap allocation within the host JVM process. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L) confirms local-only access, low complexity, low privileges, and availability-only impact. No CPE string was provided in the input data.

RemediationAI

No vendor-released patch has been identified at time of analysis. The project was notified via GitHub issue https://github.com/HdrHistogram/HdrHistogram/issues/220 but has not responded. As a primary compensating control, callers should validate numberOfSignificantValueDigits before passing any byte buffer to decodeFromByteBuffer - the HdrHistogram specification defines valid values as integers 1 through 5, so reject any deserialized value outside this range. Additionally, configuring explicit JVM heap limits via -Xmx can cap the damage radius, though this will cause an OutOfMemoryError in the JVM process rather than gracefully rejecting the input. Wrapping decodeFromByteBuffer calls in a try-catch for OutOfMemoryError and IllegalArgumentException allows applications to reject malformed input without crashing. Monitor the upstream GitHub issue and repository for a patch release before upgrading.