An input‑controlled memory allocation flaw in HdrHistogram's AbstractHistogram.decodeFromByteBuffer allows a local attacker to specify an excessively large numberOfSignificantValueDigits parameter, causing the library to allocate large amounts of memory and potentially exhaust system resources. The vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption) and CWE-789 (Out‑of‑Bounds Array Access). The impact is a denial of service, with no direct threat to confidentiality or integrity as the flaw requires local execution and influences only resource usage.

The affected product is the HdrHistogram library, version 2.2.2 and earlier. The vulnerability is present in the org.HdrHistogram.AbstractHistogram decoding routine across all builds of the library up to the stated version.

The CVSS score of 4.8 indicates moderate severity. EPSS is not available, so the public likelihood of exploitation is uncertain, but the flaw has already been publicly disclosed and an exploit is known. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is local, meaning the attacker must be able to execute code that invokes the vulnerable method on the same host. Without local code execution, the flaw cannot be triggered.