A flaw exists in the HdrHistogram Java library in the method org.HdrHistogram.AbstractHistogram.decodeFromCompressedByteBuffer. The method allocates memory based on the lengthOfCompressedContents parameter without performing any bounds checking. If an attacker supplies a the library will attempt to allocate a proportion available memory and causing an out‑of‑memory error. This weakness maps to CWE‑400 (Uncontrolled Resource Consumption), CWE‑770 (Improper Restriction of Operations within the Bounds of a Memory (Out‑of‑Memory Condition). The impact is a denial‑of‑service scenario, where the hosting application may crash or become unresponsive but no code execution or privilege escalation is possible.

The vulnerability affects the HdrHistogram Java library for all versions up to and including 2.2.2. Any application that uses this library and invokes the decodeFromCompressedByteBuffer method is impacted, regardless of the vendor since it is an open‑source component.

The CVSS score of 4.8 indicates moderate severity, and the EPSS score of less than 1 % indicates a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires local access to an application that performs the decompression and the ability to provide a malicious compressed histogram payload. Because the flaw does not grant code execution, the primary risk is application instability or denial of service through heap exhaustion.