Read the docs
TI-2026-79202 Aliases CVE-2026-103634GHSA-8255-5x7v-6cgv

Memory corruption in Apache DataSketches C++ Count-Min sketch loading

Priority LOW 31CWE-190Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

Apache DataSketches C++ (datasketches-cpp) from 4.1.0 through 5.2.0 has out-of-bounds reads and writes in Count-Min sketch deserialization. A 32-bit table size calculation can wrap to zero (CWE-190), so a crafted sketch makes later updates and queries write outside the heap allocation (CWE-787). A truncated sketch can also cause a read past the end of the input. Only applications that deserialize Count-Min sketches from untrusted sources are affected, and the flaw can corrupt heap memory and crash the application.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Out-of-bounds read and write in the Count-Min sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). count_min_sketch::deserialize() did not include the preamble in its input size check, so a truncated sketch could cause a read of up to 16 bytes past the end of the input. In addition, the table size was computed from the serialized number of buckets and number of hash functions in 32-bit arithmetic. A crafted sketch could make it wrap to zero, so that the sketch deserialized with an empty table, and later updates and estimate queries read and wrote outside the heap allocation. This can corrupt heap memory, causing a crash and potentially enabling further exploitation. This issue affects Apache DataSketches C++: from 4.1.0 before 5.3.0. Only applications that deserialize Count-Min sketches from untrusted sources are affected. Users are recommended to upgrade to version 5.3.0, which fixes this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00486 42nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache DataSketches4.1.0 – 5.2.0—No fix listedCNA
  • Apache DataSketches VendorApache Affected 4.1.0 – 5.2.0 Fixed in — No fix listed CNA

Remediation

Upgrade to Apache DataSketches 5.3.0, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-22 Threatist record created from CVE-2026-103634
  2. 2026-10-22 Alias added: GHSA-8255-5x7v-6cgv
  3. 2026-10-26 CVSS score added · CISA ADP
  4. 2026-10-26 CISA SSVC decision points changed

References

Advisory 1

Other 1

  • TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
  • TI-2024-30292 Apache OFBiz: Confused controller-view authorization logic (forced browsing) KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-26062 Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-21190 Apache OFBiz: Path traversal leading to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-18186 Apache HugeGraph-Server: Command execution in gremlin KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-25106 Deserialization of untrusted data in Apache ActiveMQ KEVCVSS 3.1CRITICAL 10.0
See all 4053 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences