CVE-2026-103635: Apache DataSketches: datasketches-cpp: Out-of-bounds read in compact Theta sketch deserialization allows denial of service via a crafted sketch
CVE-2026-103635 lets crafted compact Theta sketches trigger an out-of-bounds read in Apache DataSketches C++.
Apache DataSketches C++ versions 3.1.0 through 5.2.0 are affected by CVE-2026-103635, an out-of-bounds read in compact Theta sketch deserialization. compact_theta_sketch::deserialize() and wrapped_compact_theta_sketch::wrap() read header fields before checking that the input is long enough. For the compressed format, a 32-bit integer overflow can defeat the size check. Apache rated the issue low; a crafted sketch can cause denial of service, and no exploitation is reported.
- CVE-2026-103635 is an out-of-bounds read in compact Theta deserialization.
- DataSketches C++ 3.1.0 through 5.2.0 are affected.
- Header fields are read before the input length is checked.
- A 32-bit overflow can defeat the compressed-format size check.
- CVEs
- CVE-2026-103635
- Vendors
- Apache Software Foundation
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-103635 | Out-of-bounds read in Apache DataSketches C++ Theta sketches | 9.1 | — |
From the original article
Posted by Lee Rhodes on Oct 10 Severity: low Affected versions: - Apache DataSketches 3. 1. 0 through 5.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.