Log in Start free

Vulnerability · Published Jul 4, 2026 · Assigned by VulDB

CVE-2026-14684HdrHistogram AbstractHistogram.java memory allocation

Low 3.3

In plain English

A low-severity uncontrolled resource consumption in HdrHistogram. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.2%top 94.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A flaw has been found in HdrHistogram up to 2.2.2. This affects the function org.HdrHistogram.AbstractHistogram.decodeFromByteBuffer of the file src/main/java/org/HdrHistogram/AbstractHistogram.java. This manipulation of the argument numberOfSignificantValueDigits causes uncontrolled memory allocation. The attack can only be executed locally. The exploit has been published and may be used. The actual existence of this vulnerability is currently in question. This issue is disputed due to the potential lack of crossing of security boundaries and the pre-requisites for a successful attack.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12hdrhistogramno fix listedDEBIAN-CVE-2026-14684
Debian:13hdrhistogramno fix listedDEBIAN-CVE-2026-14684
Debian:14hdrhistogram2.2.2-1DEBIAN-CVE-2026-14684
Ubuntu:22.04:LTShdrhistogramno fix listedUBUNTU-CVE-2026-14684
Ubuntu:24.04:LTShdrhistogramno fix listedUBUNTU-CVE-2026-14684
Ubuntu:25.10hdrhistogramno fix listedUBUNTU-CVE-2026-14684
Ubuntu:26.04:LTShdrhistogramno fix listedUBUNTU-CVE-2026-14684
Ubuntu:26.10hdrhistogramno fix listedUBUNTU-CVE-2026-14684

Affected products (as reported)

VendorProductVersions
n/a HdrHistogram 2.2.02.2.12.2.2

Weakness: CWE-789, CWE-400 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R

References