This flaw resides in the HdrHistogram library’s AbstractHistogram.decodeFromByteBuffer routine. An attacker who can invoke the method with a crafted numberOfSignificantValueDigits value may force the routine to allocate an excessively large internal buffer, which can exhaust the process’s memory and cause a service interruption. The CVE notes that the existence of the flaw remains disputed, so the denial‑of‑service impact is inferred from the described behavior rather than confirmed by a verified exploit.

The vulnerable component is the HdrHistogram library, affecting all releases up to and including version 2.2.2. This includes every build that contains the src/main/java/org/HdrHistogram/AbstractHistogram.java file as distributed by the project’s standard releases.

The CVSS score of 4.8 indicates moderate severity, while the EPSS score of less than 1 % reflects a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local code execution; an attacker must be able to run code that calls the vulnerable method, which is why the attack surface is limited to environments that execute untrusted code against the library. An exploit has been published, but because the CVE description states that the flaw’s existence is disputed, organizations that only run trusted code may consider the risk modest while those that accept external input into the method should evaluate potential impact. The main consequence is a possible denial of service through memory exhaustion, with no known effect on confidentiality or integrity.