T Digest
Monthly
Unvalidated deserialization input in t-digest 3.1-3.3 exposes any service calling MergingDigest.fromBytes on attacker-controlled data to denial of service - the method reads length and capacity fields from the serialized header and uses them directly to allocate and index arrays without bounds checking, triggering ArrayIndexOutOfBoundsException or NegativeArraySizeException and aborting the parsing thread. Any analytics pipeline or API endpoint that accepts serialized t-digest state from external callers is vulnerable to remote, unauthenticated thread termination. No public exploit code has been identified at time of analysis, and this CVE is not in the CISA KEV catalog.
Deserialization in t-digest 3.1 through 3.3 allows remote attackers to inject IEEE 754 NaN values as centroid means via crafted byte streams passed to MergingDigest.fromBytes(), bypassing absent validation checks. The injected NaN values corrupt the internal total-ordering invariant of the centroid list, causing sort comparisons to return inconsistent results and degrading subsequent merge operations from O(n log n) to O(n²) algorithmic complexity. The result is severe CPU exhaustion and service delays for any application that deserializes attacker-controlled t-digest payloads; no public exploit code or CISA KEV listing exists at time of analysis.
Unvalidated deserialization input in t-digest 3.1-3.3 exposes any service calling MergingDigest.fromBytes on attacker-controlled data to denial of service - the method reads length and capacity fields from the serialized header and uses them directly to allocate and index arrays without bounds checking, triggering ArrayIndexOutOfBoundsException or NegativeArraySizeException and aborting the parsing thread. Any analytics pipeline or API endpoint that accepts serialized t-digest state from external callers is vulnerable to remote, unauthenticated thread termination. No public exploit code has been identified at time of analysis, and this CVE is not in the CISA KEV catalog.
Deserialization in t-digest 3.1 through 3.3 allows remote attackers to inject IEEE 754 NaN values as centroid means via crafted byte streams passed to MergingDigest.fromBytes(), bypassing absent validation checks. The injected NaN values corrupt the internal total-ordering invariant of the centroid list, causing sort comparisons to return inconsistent results and degrading subsequent merge operations from O(n log n) to O(n²) algorithmic complexity. The result is severe CPU exhaustion and service delays for any application that deserializes attacker-controlled t-digest payloads; no public exploit code or CISA KEV listing exists at time of analysis.