CVE-2026-87962 t-digest 3.1 through 3.3 Denial of Service via Unvalidated Length Fields in MergingDigest.fromBytes
Attackers can cause a denial of service in the t-digest library by supplying crafted serialized data with invalid length fields, crashing the parsing thread.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-87962?
CVE-2026-87962 is a high-severity denial of service vulnerability in tdunning t-digest, published on 10 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
t-digest versions 3.1 through 3.3 contain a denial of service vulnerability in MergingDigest.fromBytes that fails to validate length and capacity fields from serialized data. Attackers can supply crafted serialized digests with mismatched header fields to trigger ArrayIndexOutOfBoundsException or NegativeArraySizeException, aborting the parsing thread.
Weakness: CWE-1284
Which versions are affected by CVE-2026-87962?
How do I fix CVE-2026-87962?
No fix has been published for CVE-2026-87962 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-87962 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-87962 exists.
Sources
Also known as GHSA-p7mw-7cfx-cr67, UBUNTU-CVE-2026-87962.