CVE-2026-103501: Apache DataSketches: datasketches-cpp: HLL CouponList Deserialization Buffer Overflow allows memory corruption via a crafted sketch
Apache DataSketches C++ HLL LIST deserialization has a heap overflow from an unchecked coupon count.
Apache disclosed CVE-2026-103501, a moderate heap buffer overflow in HLL sketch deserialization in datasketches-cpp. Versions 1.0.0-incubating through 5.2.0 are affected. When deserializing a sketch in LIST mode from a byte buffer or stream, the coupon count read from the input is used as the number of entries copied into a fixed buffer of eight entries without a bounds check, allowing memory corruption via a crafted sketch. No active exploitation is stated.
- CVE-2026-103501 affects datasketches-cpp 1.0.0-incubating through 5.2.0.
- HLL LIST-mode deserialization copies an unchecked coupon count into an 8-entry buffer.
- The resulting heap buffer overflow can corrupt memory from a crafted sketch.
- Apache rates the issue moderate; exploitation is not reported.
- CVEs
- CVE-2026-103501
- Vendors
- Apache
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-103501 | Heap Buffer Overflow in Apache DataSketches C++ HLL Deserialization | 9.8 | — |
From the original article
Posted by Lee Rhodes on Oct 10 Severity: moderate Affected versions: - Apache DataSketches 1. 0. 0-incubating through 5.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.