Read the docs
TI-2026-70322 Aliases CVE-2026-103635GHSA-hh2m-8j82-33gp

Out-of-bounds read in Apache DataSketches C++ compact Theta sketches

Priority MEDIUM 45CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

Apache DataSketches C++ from 3.1.0 before 5.3.0 has an out-of-bounds read (CWE-125) in compact Theta sketch deserialization. The header fields are read before the input length is checked, and for the compressed format a 32-bit overflow can defeat that check. An attacker who supplies a crafted or truncated sketch can make the library read past the end of the input, which can crash the application and expose adjacent memory contents. Only applications that deserialize Theta sketches from untrusted sources are affected.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Out-of-bounds read in the compact Theta sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). compact_theta_sketch::deserialize() and wrapped_compact_theta_sketch::wrap() read header fields before checking that the input was long enough. For the compressed format, the size check could be defeated by a 32-bit overflow, and two header fields that control decoding were not validated; this also affected deserialization from a stream. A crafted or truncated sketch could cause a read past the end of the input. In the compressed case the over-read can be large, and the bytes read can become part of the deserialized sketch. This can cause a crash (denial of service) and could expose adjacent memory contents. This issue affects Apache DataSketches C++: from 3.1.0 before 5.3.0. Only applications that deserialize Theta sketches from untrusted sources are affected. Users are recommended to upgrade to version 5.3.0, which fixes this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00394 33rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache DataSketches3.1.0 – 5.2.0—No fix listedCNA
  • Apache DataSketches VendorApache Affected 3.1.0 – 5.2.0 Fixed in — No fix listed CNA

Remediation

Upgrade Apache DataSketches C++ to version 5.3.0, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-10 Threatist record created from CVE-2026-103635
  2. 2026-10-11 Alias added: GHSA-hh2m-8j82-33gp
  3. 2026-10-16 CVSS score added · CISA ADP
  4. 2026-10-16 CISA SSVC decision points changed
  5. 2026-10-16 Priority changed: LOW → MEDIUM

References

Advisory 1

Other 1

  • TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
  • TI-2024-30292 Apache OFBiz: Confused controller-view authorization logic (forced browsing) KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-26062 Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-21190 Apache OFBiz: Path traversal leading to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-18186 Apache HugeGraph-Server: Command execution in gremlin KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-25106 Deserialization of untrusted data in Apache ActiveMQ KEVCVSS 3.1CRITICAL 10.0
See all 4053 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences