DataSketches Java through 9.0.0 can exhaust memory on crafted input
Original title: CVE-2026-122096: Apache DataSketches Java: Uncontrolled resource consumption when deserializing crafted sketch images
Deserializers trusted sizes in serialized sketch images, so a small input could trigger an OutOfMemoryError.
Apache DataSketches Java through 9.0.0 has an uncontrolled resource consumption flaw in sketch deserialization, tracked as CVE-2026-122096. Several deserializers trusted sizes and counts declared in serialized input. A small crafted input could force excessive memory allocation and an OutOfMemoryError. The oss-security post rates severity as low; the snippet does not name a fixed version.
Unconfirmed: The feed snippet is truncated, so the full trigger and any fix are not shown.
- Lee Rhodes posted the notice on November 10.
- The affected range is Apache DataSketches Java through 9.0.0.
- The listed severity is low.
- The feed snippet is cut off before finishing the crafted-string description.
Impact: Excessive memory allocation causing an OutOfMemoryError
| Product | Affected |
|---|---|
| Apache DataSketches Java | through 9.0.0 |
- CVEs
- CVE-2026-122096
- Vendors
- Apache
- Products
- DataSketches Java
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-122096 | Resource exhaustion in Apache DataSketches Java deserialization | — | — |
From the original article
Posted by Lee Rhodes on Nov 10 Severity: low Affected versions: - Apache DataSketches Java through 9. 0. 0 Description: Uncontrolled Resource Consumption vulnerability in the sketch deserialization of Apache DataSketches Java.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.