CVE-2026-87822

t-digest versions 3.1 through 3.3 do not validate centroid means when a serialized digest is parsed in MergingDigest.fromBytes, letting an attacker inject NaN centroids that pass the library's validation checks (algorithmic-complexity flaw, CWE-407). A crafted digest supplied over a network (CVSS 4.0 shows AV:N with no privileges or user interaction) degrades the sorting used during merge operations from O(n log n) to O(n squared), causing severe, CPU-bound processing delays that amount to a denial of service with high availability impact and no confidentiality or integrity impact. Any application or service embedding t-digest 3.1-3.3 and deserializing digests from untrusted sources is affected, while deployments that never deserialize attacker-supplied digests are not meaningfully exposed. No public proof-of-concept is known, the issue is not in CISA's Known Exploited Vulnerabilities catalog, and there are no reports of exploitation in the wild.

What to do: Upgrade t-digest to a patched release newer than 3.3 as soon as one is available, and in the meantime avoid deserializing digests from untrusted sources or explicitly reject NaN centroid means around MergingDigest.fromBytes. Audit code paths that pass user- or network-supplied data to MergingDigest.fromBytes, and monitor CPU and latency on merge-heavy endpoints for signs of abuse.