Copyright © 2012 Red Hat, Inc. All rights reserved. Low 2026-07-04T23:30:10 org.hdrhistogram/HdrHistogram: HdrHistogram: HdrHistogram: Denial of Service via uncontrolled memory allocation in decodeFromByteBuffer 5.0 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H CWE-770

A flaw has been found in HdrHistogram up to 2.2.2. This affects the function org.HdrHistogram.AbstractHistogram.decodeFromByteBuffer of the file src/main/java/org/HdrHistogram/AbstractHistogram.java. This manipulation of the argument numberOfSignificantValueDigits causes uncontrolled memory allocation. The attack can only be executed locally. The exploit has been published and may be used. The actual existence of this vulnerability is currently in question. This issue is disputed due to the potential lack of crossing of security boundaries and the pre-requisites for a successful attack.

A flaw was found in HdrHistogram. A local attacker can exploit a vulnerability in the `decodeFromByteBuffer` function by manipulating the `numberOfSignificantValueDigits` argument. This manipulation leads to uncontrolled memory allocation, which can result in a Denial of Service (DoS) condition, making the affected system or application unavailable.

Successful exploitation requires local access, as an attacker must be able to supply specially crafted, manipulated input directly to an application that is actively utilizing the affected HdrHistogram library. The vulnerability is strictly limited to causing a Denial of Service (DoS) via uncontrolled memory allocation. It does not allow an attacker to execute arbitrary code, escalate privileges, or access unauthorized data. Furthermore, the impact is localized to the specific application processing the malicious input, rather than causing a broader, system-wide compromise. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat Hardened Images 2026-06-18T00:00:00Z RHSA-2026:26989 netavark-main-2.0.0-1.hum1 Red Hat Hardened Images 2026-07-02T00:00:00Z RHSA-2026:34975 rust-main-1.96.1-1.hum1 Logging Subsystem for Red Hat OpenShift Fix deferred openshift-logging/vector-rhel9 OpenShift Lightspeed Fix deferred openshift-lightspeed/lightspeed-ocp-rag-rhel9 OpenShift Lightspeed Fix deferred openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 OpenShift Service Mesh 3 Fix deferred openshift-service-mesh/istio-ztunnel-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-25/lightspeed-chatbot-rhel8 Red Hat Enterprise Linux 8 Fix deferred HdrHistogram Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-llm-d-inference-scheduler-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-model-registry-job-async-upload-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred conmon-rs Red Hat OpenShift Update Service Fix deferred openshift-update-service/openshift-update-service-rhel8 https://www.cve.org/CVERecord?id=CVE-2026-14684 https://nvd.nist.gov/vuln/detail/CVE-2026-14684 https://github.com/HdrHistogram/HdrHistogram/ https://github.com/HdrHistogram/HdrHistogram/issues/220 https://vuldb.com/cve/CVE-2026-14684 https://vuldb.com/submit/846754 https://vuldb.com/vuln/376280 https://vuldb.com/vuln/376280/cti