CVE-2026-122096

Beschreibung

Uncontrolled Resource Consumption vulnerability in the sketch deserialization of Apache DataSketches Java. Several deserializers trusted sizes and counts declared in the serialized input. A small crafted input could make an application allocate an excessive amount of memory, leading to an OutOfMemoryError. A crafted string passed to FrequentLongsSketch.getInstance(String) could also make deserialization, or a later update, loop indefinitely. Only applications that deserialize sketches from untrusted sources are affected. This issue affects Apache DataSketches Java: through 9.0.0. Users are recommended to upgrade to version 9.1.0, which fixes the issue.

Referenzen

• https://github.com/apache/datasketches-java/pull/777
• https://github.com/apache/datasketches-java/pull/783
• https://github.com/apache/datasketches-java/releases/tag/9.1.0
• https://lists.apache.org/thread/9wd7ngmho7hm8x74sq1p2fp1xgjd8kt6
• http://www.openwall.com/lists/oss-security/2026/11/10/29