A reported issue in HdrHistogram up to version 2.2.2 involves the function org.HdrHistogram.AbstractHistogram.decodeFromCompressedByteBuffer, where the lengthOfCompressedContents argument is used to allocate memory without bounds checking. Such unchecked allocation could lead to an out‑of‑memory condition if an attacker supplies a large value, potentially causing a denial‑of‑service. However, the CVE notes that the vulnerability’s existence and exploitability are disputed, leaving uncertainty about whether the flaw can be leveraged in practice.

The HdrHistogram Java library, used in many Java applications for histogram data, is affected for all releases up to and including 2.2.2. Any Java application that incorporates this library and calls decodeFromCompressedByteBuffer to deserialize compressed histograms may be impacted, regardless of the upstream vendor since the component is open source.

The CVSS score of 4.8 indicates moderate severity, while an EPSS score of less than 1 % reflects a very low perceived chance of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require local access to an application that performs histogram decompression and the ability to supply a maliciously crafted compressed payload. Because the CVE states that the flaw’s existence and practical risk are debated, the overall threat remains uncertain and organizations should verify whether the vulnerable code paths are present before taking action.