HdrHistogram CVE-2026-14685

Q: What is the CVSS score of CVE-2026-14685?

CVE-2026-14685 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-41707 LOW

State Issues (CWE-371)

2026-07-05 cna@vuldb.com

GHSA-j3mx-fh6g-v48r

Java Information Disclosure

1.9

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

1.9 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.3 LOW

Local-only vector with low privileges required; only low integrity impact on histogram state, no confidentiality or availability consequence.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 00:28 vuln.today

DescriptionCVE.org

A vulnerability has been found in HdrHistogram up to 2.2.2. This vulnerability affects the function recordValueWithCount of the file src/main/java/org/HdrHistogram/AbstractHistogram.java of the component AbstractHistogram. Such manipulation of the argument Count leads to state issue. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

State corruption in HdrHistogram up to version 2.2.2 allows a local, low-privileged attacker to manipulate the Count argument of the recordValueWithCount function in AbstractHistogram.java, resulting in low-integrity corruption of histogram state. The flaw affects the core metrics-recording logic of this Java library. A proof-of-concept exploit has been publicly disclosed; the project maintainer was notified via a GitHub issue but has not yet responded with a fix, leaving affected deployments without a vendor patch.

Technical ContextAI

HdrHistogram is an open-source Java library (org.HdrHistogram) designed for high-dynamic-range, low-latency histogram recording, widely embedded in performance-measurement stacks. The affected code resides in AbstractHistogram.java, specifically in the recordValueWithCount method, which accumulates counts for histogram buckets. CWE-371 (State Issues) identifies the root cause as improper management of internal object state - by supplying a crafted Count value, an attacker can drive the histogram object into an inconsistent or unexpected state. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) confirms exploitation is entirely local with no special attack prerequisites beyond low OS-level privileges. The library is typically consumed as a Maven/Gradle dependency inside JVM-based applications.

RemediationAI

No vendor-released patch has been identified at time of analysis. The upstream project was notified through GitHub issue #221 but has not responded. Organizations should monitor the repository at https://github.com/HdrHistogram/HdrHistogram/ for a patched release. As a compensating control, applications that expose histogram recording functionality to untrusted local callers should validate the Count argument before passing it to recordValueWithCount, rejecting negative or implausibly large values at the application layer - this prevents malformed state without requiring a library update. Alternatively, restrict OS-level access to JVM processes that use HdrHistogram so that only authorized application accounts can interact with the recording logic. Because the integrity impact is limited to histogram state, a further mitigation is to periodically reset or reinitialize histogram objects from a trusted baseline to limit the duration of any corrupted state. Given the very low CVSS score and local-only attack vector, this issue is a low-priority patching target for most deployments.