Vulnerabilities

TI-2026-60002 CVE-2026-87962 · GHSA-p7mw-7cfx-cr67

t-digest 3.1 through 3.3 Denial of Service via Unvalidated Length Fields in MergingDigest.fromBytes

HIGH 77

t-digest versions 3.1 through 3.3 contain a denial of service vulnerability in MergingDigest.fromBytes that fails to validate length and capacity fields from serialized data.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0063 Published 2026-09-10 No fix listed CWE-1284

TI-2026-59939 CVE-2026-87822 · GHSA-32f6-mgwr-pvc4

t-digest 3.1 through 3.3 Denial of Service via NaN Centroid Means in MergingDigest.fromBytes

MEDIUM 45

t-digest versions 3.1 through 3.3 fail to validate centroid means during deserialization in MergingDigest.fromBytes, allowing attackers to inject NaN values that bypass validation checks.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0067 Published 2026-09-09 No fix listed CWE-407

Vulnerabilities

Filters

t-digest 3.1 through 3.3 Denial of Service via Unvalidated Length Fields in MergingDigest.fromBytes

t-digest 3.1 through 3.3 Denial of Service via NaN Centroid Means in MergingDigest.fromBytes