Apache Datasketches
Monthly
Out-of-bounds read in Apache DataSketches C++ (datasketches-cpp) allows an attacker who controls a serialized VarOpt union image to trigger reads of up to 24 bytes past the end of the supplied buffer, causing a crash (denial of service) and potentially leaking adjacent heap memory into the deserialized union's state. Applications are exposed only if they call var_opt_union::deserialize() on data from untrusted sources; affected releases are 2.0.0-incubating through 5.2.0, and the library is not exploitable on its own. No public exploit code has been identified at time of analysis, EPSS is low at 0.24% (14th percentile), and the issue is not listed in CISA KEV, so the practical priority is moderate rather than urgent. The vendor-released fix is version 5.3.0, which also remediates four other deserialization flaws.
Out-of-bounds read in Apache DataSketches C++ versions 3.1.0 through 5.2.0 is reachable when an application deserializes a compact Theta sketch from an untrusted source, allowing unauthenticated remote attackers to crash the process (denial of service) and potentially disclose adjacent memory contents. The flaw sits in compact_theta_sketch::deserialize() and wrapped_compact_theta_sketch::wrap(), which parse header fields before verifying the input length; in the compressed format a 32-bit integer overflow defeats the length check and two decoding-controlling header fields go unvalidated, and the stream-based deserialization path is affected as well. Apache rates this issue low severity in its 5.3.0 release notes, no public exploit code has been identified at time of analysis, the vulnerability is not in CISA KEV, and EPSS is only 0.20% (9th percentile); exploitation requires the explicit, non-default precondition that the host application accept Theta sketch images from untrusted sources, so the practical priority is lower than the raw 9.1 CVSS might suggest.
Out-of-bounds read and write in the CPC sketch deserialization path of Apache DataSketches C++ (datasketches-cpp) - specifically cpc_sketch::deserialize() called on a byte buffer or a stream - allows a crafted serialized sketch to corrupt heap memory: the decompressor reads past the end of the compressed data because the read position was only checked after decoding finished, and in the hybrid flavor it writes outside an internal heap buffer because decoded row indices were not validated, crashing the process with potential for further exploitation. All releases from 2.0.0-incubating before 5.3.0 are affected, and the CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating remote, unauthenticated impact, but reachability is conditional: only applications that deserialize CPC sketches from untrusted sources are exposed, since the flaw lives in a C++ library whose attack surface depends on the embedding application. Exploitation signals are mixed and should be weighed carefully - EPSS is only 0.19% (8th percentile), there is no CISA KEV entry, and no public exploit identified at time of analysis.
Heap buffer overflow in Apache DataSketches C++ (versions 1.0.0-incubating through 5.2.0) allows an unauthenticated remote attacker who can supply a crafted HLL sketch for deserialization to write up to 988 bytes past a fixed 8-entry internal heap buffer, corrupting memory, crashing the process, and potentially enabling further exploitation. The vulnerable code is a library routine with no network listener of its own, so real-world exposure hinges on whether the consuming application deserializes sketch images from untrusted byte buffers or streams; services that only process trusted or internally generated sketches are not realistically exposed despite the AV:N vector. No public exploit code has been identified at time of analysis, and EPSS is low at 0.21% (11th percentile), while the assessed CVSS 3.1 base of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects the worst case for applications that do accept untrusted sketches, meaning the high score and low observed exploitation signal must be weighed together.
Out-of-bounds read in Apache DataSketches C++ (datasketches-cpp) allows an attacker who controls a serialized VarOpt union image to trigger reads of up to 24 bytes past the end of the supplied buffer, causing a crash (denial of service) and potentially leaking adjacent heap memory into the deserialized union's state. Applications are exposed only if they call var_opt_union::deserialize() on data from untrusted sources; affected releases are 2.0.0-incubating through 5.2.0, and the library is not exploitable on its own. No public exploit code has been identified at time of analysis, EPSS is low at 0.24% (14th percentile), and the issue is not listed in CISA KEV, so the practical priority is moderate rather than urgent. The vendor-released fix is version 5.3.0, which also remediates four other deserialization flaws.
Out-of-bounds read in Apache DataSketches C++ versions 3.1.0 through 5.2.0 is reachable when an application deserializes a compact Theta sketch from an untrusted source, allowing unauthenticated remote attackers to crash the process (denial of service) and potentially disclose adjacent memory contents. The flaw sits in compact_theta_sketch::deserialize() and wrapped_compact_theta_sketch::wrap(), which parse header fields before verifying the input length; in the compressed format a 32-bit integer overflow defeats the length check and two decoding-controlling header fields go unvalidated, and the stream-based deserialization path is affected as well. Apache rates this issue low severity in its 5.3.0 release notes, no public exploit code has been identified at time of analysis, the vulnerability is not in CISA KEV, and EPSS is only 0.20% (9th percentile); exploitation requires the explicit, non-default precondition that the host application accept Theta sketch images from untrusted sources, so the practical priority is lower than the raw 9.1 CVSS might suggest.
Out-of-bounds read and write in the CPC sketch deserialization path of Apache DataSketches C++ (datasketches-cpp) - specifically cpc_sketch::deserialize() called on a byte buffer or a stream - allows a crafted serialized sketch to corrupt heap memory: the decompressor reads past the end of the compressed data because the read position was only checked after decoding finished, and in the hybrid flavor it writes outside an internal heap buffer because decoded row indices were not validated, crashing the process with potential for further exploitation. All releases from 2.0.0-incubating before 5.3.0 are affected, and the CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating remote, unauthenticated impact, but reachability is conditional: only applications that deserialize CPC sketches from untrusted sources are exposed, since the flaw lives in a C++ library whose attack surface depends on the embedding application. Exploitation signals are mixed and should be weighed carefully - EPSS is only 0.19% (8th percentile), there is no CISA KEV entry, and no public exploit identified at time of analysis.
Heap buffer overflow in Apache DataSketches C++ (versions 1.0.0-incubating through 5.2.0) allows an unauthenticated remote attacker who can supply a crafted HLL sketch for deserialization to write up to 988 bytes past a fixed 8-entry internal heap buffer, corrupting memory, crashing the process, and potentially enabling further exploitation. The vulnerable code is a library routine with no network listener of its own, so real-world exposure hinges on whether the consuming application deserializes sketch images from untrusted byte buffers or streams; services that only process trusted or internally generated sketches are not realistically exposed despite the AV:N vector. No public exploit code has been identified at time of analysis, and EPSS is low at 0.21% (11th percentile), while the assessed CVSS 3.1 base of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects the worst case for applications that do accept untrusted sketches, meaning the high score and low observed exploitation signal must be weighed together.