Log in Start free

Vulnerability · Published Jul 4, 2026 · Assigned by VulDB

CVE-2026-14683HdrHistogram AbstractHistogram.java memory allocation

Low 3.3

In plain English

A low-severity uncontrolled resource consumption in HdrHistogram. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.2%top 94.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was detected in HdrHistogram up to 2.2.2. Affected by this issue is the function org.HdrHistogram.AbstractHistogram.decodeFromCompressedByteBuffer of the file src/main/java/org/HdrHistogram/AbstractHistogram.java. The manipulation of the argument lengthOfCompressedContents results in uncontrolled memory allocation. The attack needs to be approached locally. The exploit is now public and may be used. It is still unclear if this vulnerability genuinely exists. This issue is disputed due to the potential lack of crossing of security boundaries and the pre-requisites for a successful attack.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12hdrhistogramno fix listedDEBIAN-CVE-2026-14683
Debian:13hdrhistogramno fix listedDEBIAN-CVE-2026-14683
Debian:14hdrhistogram2.2.2-1DEBIAN-CVE-2026-14683
Ubuntu:22.04:LTShdrhistogramno fix listedUBUNTU-CVE-2026-14683
Ubuntu:24.04:LTShdrhistogramno fix listedUBUNTU-CVE-2026-14683
Ubuntu:25.10hdrhistogramno fix listedUBUNTU-CVE-2026-14683
Ubuntu:26.04:LTShdrhistogramno fix listedUBUNTU-CVE-2026-14683
Ubuntu:26.10hdrhistogramno fix listedUBUNTU-CVE-2026-14683

Affected products (as reported)

VendorProductVersions
n/a HdrHistogram 2.2.02.2.12.2.2

Weakness: CWE-789, CWE-400 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R

References