CVE-2026-87962

CVE-2026-87962 is a denial-of-service flaw in the t-digest library's MergingDigest.fromBytes deserialization routine, which reads the length and capacity fields from the serialized header without validating them (CWE-1284). An attacker who can supply serialized digest bytes to an affected application can craft a digest with mismatched header fields, causing the parser to allocate or index arrays incorrectly and throw an ArrayIndexOutOfBoundsException or NegativeArraySizeException. Because the exception is unhandled in fromBytes, it aborts the parsing thread; if the calling application does not catch it, repeated crafted digests can disrupt or exhaust processing workers, producing a denial of service (CVSS 4.0 rates the availability impact High at 8.7). Only applications running t-digest versions 3.1 through 3.3 that deserialize attacker-controlled or otherwise untrusted digest data are affected; deployments that only compute digests internally from their own data are not directly exposed. There are no reports of in-the-wild exploitation, no public proof-of-concept, and the issue is not listed in CISA's KEV.

What to do: Upgrade t-digest to a fixed release (any version after 3.3) once available and rebuild/redeploy applications that bundle the library. Until then, restrict deserialization of digest bytes to trusted sources or wrap MergingDigest.fromBytes calls with exception handling and pre-validation of the header's length and capacity fields. Operators of analytics platforms that embed t-digest should check with the platform vendor for patched builds and whether their deserialization path accepts untrusted input.