Copyright © 2012 Red Hat, Inc. All rights reserved. Low 2026-07-04T23:00:10 HdrHistogram: HdrHistogram: Denial of Service via uncontrolled memory allocation 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CWE-770

A vulnerability was detected in HdrHistogram up to 2.2.2. Affected by this issue is the function org.HdrHistogram.AbstractHistogram.decodeFromCompressedByteBuffer of the file src/main/java/org/HdrHistogram/AbstractHistogram.java. The manipulation of the argument lengthOfCompressedContents results in uncontrolled memory allocation. The attack needs to be approached locally. The exploit is now public and may be used. It is still unclear if this vulnerability genuinely exists. This issue is disputed due to the potential lack of crossing of security boundaries and the pre-requisites for a successful attack.

A flaw was found in HdrHistogram. A local attacker can exploit a vulnerability in the `decodeFromCompressedByteBuffer` function by manipulating the `lengthOfCompressedContents` argument. This manipulation leads to uncontrolled memory allocation, which can result in a Denial of Service (DoS) condition, making the affected system unavailable.

Low impact. A local attacker can exploit a flaw in HdrHistogram's `decodeFromCompressedByteBuffer` function by manipulating input, leading to uncontrolled memory allocation and a denial of service. This issue requires local access and results in resource exhaustion, not arbitrary code execution or data compromise. Red Hat Hardened Images 2026-06-18T00:00:00Z RHSA-2026:26989 netavark-main-2.0.0-1.hum1 Red Hat Hardened Images 2026-07-02T00:00:00Z RHSA-2026:34975 rust-main-1.96.1-1.hum1 Logging Subsystem for Red Hat OpenShift Not affected openshift-logging/vector-rhel9 OpenShift Lightspeed Not affected openshift-lightspeed/lightspeed-ocp-rag-rhel9 OpenShift Lightspeed Not affected openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 OpenShift Service Mesh 3 Not affected openshift-service-mesh/istio-ztunnel-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-25/lightspeed-chatbot-rhel8 Red Hat Enterprise Linux 8 Fix deferred HdrHistogram Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-llm-d-inference-scheduler-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-model-registry-job-async-upload-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-trustyai-service-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9 Red Hat OpenShift Container Platform 4 Not affected conmon-rs Red Hat OpenShift Update Service Not affected openshift-update-service/openshift-update-service-rhel8 https://www.cve.org/CVERecord?id=CVE-2026-14683 https://nvd.nist.gov/vuln/detail/CVE-2026-14683 https://github.com/HdrHistogram/HdrHistogram/ https://github.com/HdrHistogram/HdrHistogram/issues/219 https://vuldb.com/cve/CVE-2026-14683 https://vuldb.com/submit/846750 https://vuldb.com/submit/846752 https://vuldb.com/vuln/376279 https://vuldb.com/vuln/376279/cti