CVE-2026-14685 HdrHistogram AbstractHistogram AbstractHistogram.java recordValueWithCount state issue
A disputed state issue in HdrHistogram's recordValueWithCount function may allow local attackers to manipulate internal state, though security boundary violations are unconfirmed.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-14685?
CVE-2026-14685 is a medium-severity vulnerability in HdrHistogram, published on 4 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability has been found in HdrHistogram up to 2.2.2. This vulnerability affects the function recordValueWithCount of the file src/main/java/org/HdrHistogram/AbstractHistogram.java of the component AbstractHistogram. Such manipulation of the argument Count leads to state issue. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. The existence of this vulnerability is still disputed at present. This issue is disputed due to the potential lack of crossing of security boundaries and the pre-requisites for a successful attack.
Weakness: CWE-371
Which versions are affected by CVE-2026-14685?
How do I fix CVE-2026-14685?
No fix published yet.
Is CVE-2026-14685 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-14685 exists.
Sources
Also known as DEBIAN-CVE-2026-14685, GHSA-j3mx-fh6g-v48r, UBUNTU-CVE-2026-14685.