EUVD-2026-75387
GHSA-p7mw-7cfx-cr67
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable unauthenticated DoS requiring no complexity beyond controlling the serialized payload; availability-only impact, no scope change or confidentiality/integrity effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
t-digest versions 3.1 through 3.3 contain a denial of service vulnerability in MergingDigest.fromBytes that fails to validate length and capacity fields from serialized data. Attackers can supply crafted serialized digests with mismatched header fields to trigger ArrayIndexOutOfBoundsException or NegativeArraySizeException, aborting the parsing thread.
AnalysisAI
Unvalidated deserialization input in t-digest 3.1-3.3 exposes any service calling MergingDigest.fromBytes on attacker-controlled data to denial of service - the method reads length and capacity fields from the serialized header and uses them directly to allocate and index arrays without bounds checking, triggering ArrayIndexOutOfBoundsException or NegativeArraySizeException and aborting the parsing thread. Any analytics pipeline or API endpoint that accepts serialized t-digest state from external callers is vulnerable to remote, unauthenticated thread termination. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target application must call MergingDigest.fromBytes on data controlled by the attacker - for example, a service that accepts serialized t-digest payloads from external clients over a network API (distributed quantile aggregation endpoints, stream-processing systems that merge remote digests, or RPC interfaces transferring t-digest state). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 8.7, reflecting a mechanically straightforward unauthenticated network-reachable denial-of-service path with no special library-side preconditions. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched version is explicitly identified in any available reference; patch status must be verified directly against the upstream repository at https://github.com/tdunning/t-digest and tracked via GitHub issue #227 (https://github.com/tdunning/t-digest/issues/227). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, enumerate all internal services and APIs using t-digest 3.1-3.3, and identify which accept serialized digest objects from untrusted sources (external callers, user uploads, third-party APIs). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today