DataSketches Java through 9.0.0 can exhaust memory on crafted input
Deserializers trusted sizes in serialized sketch images, so a small input could trigger an OutOfMemoryError.
32
CVE-2026-122096
Resource exhaustion in Apache DataSketches Java deserialization
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache DataSketches Java deserializers trusted sizes and counts in serialized sketches. An attacker who can supply untrusted sketch data can force a small input to allocate excessive memory and trigger OutOfMemoryError, or pass a crafted string to FrequentLongsSketch.getInstance(String) that loops indefinitely during deserialization or a later update. Only applications that deserialize sketches from untrusted sources, through version 9.0.0, are affected.
What to do: Upgrade Apache DataSketches Java to 9.1.0. Avoid deserializing sketches from untrusted sources until the upgrade is applied.
| Product | Affected | Fixed in |
|---|---|---|
| Apache DataSketches Java | through 9.0.0 | 9.1.0 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Uncontrolled Resource Consumption vulnerability in the sketch deserialization of Apache DataSketches Java. Several deserializers trusted sizes and counts declared in the serialized input. A small crafted input could make an application allocate an excessive amount of memory, leading to an OutOfMemoryError. A crafted string passed to FrequentLongsSketch.getInstance(String) could also make deserialization, or a later update, loop indefinitely. Only applications that deserialize sketches from untrusted sources are affected. This issue affects Apache DataSketches Java: through 9.0.0. Users are recommended to upgrade to version 9.1.0, which fixes the issue.
- Weakness
- CWE-400, CWE-789, CWE-835