CVE-2026-122096

UNKNOWN 0.0

Apache DataSketches Java: Uncontrolled resource consumption when deserializing crafted sketch images

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Uncontrolled Resource Consumption vulnerability in the sketch deserialization of Apache DataSketches Java. Several deserializers trusted sizes and counts declared in the serialized input. A small crafted input could make an application allocate an excessive amount of memory, leading to an OutOfMemoryError. A crafted string passed to FrequentLongsSketch.getInstance(String) could also make deserialization, or a later update, loop indefinitely. Only applications that deserialize sketches from untrusted sources are affected. This issue affects Apache DataSketches Java: through 9.0.0. Users are recommended to upgrade to version 9.1.0, which fixes the issue.

CWE	CWE-400 CWE-789 CWE-835
Vendor	apache software foundation
Product	apache datasketches java
Published	Nov 11, 2026
Last Updated	Nov 11, 2026

Stay Ahead of the Next One

Get instant alerts for apache software foundation apache datasketches java

Be the first to know when new unknown vulnerabilities affecting apache software foundation apache datasketches java are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Apache Software Foundation / Apache DataSketches Java

0 ≤ 9.0.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/apache/datasketches-java/releases/tag/9.1.0 github.com: https://github.com/apache/datasketches-java/pull/777 github.com: https://github.com/apache/datasketches-java/pull/783 lists.apache.org: https://lists.apache.org/thread/9wd7ngmho7hm8x74sq1p2fp1xgjd8kt6 openwall.com: http://www.openwall.com/lists/oss-security/2026/11/10/29

Credits

Jaideep Pyne