Description
A flaw has been found in HdrHistogram up to 2.2.2. This affects the function org.HdrHistogram.AbstractHistogram.decodeFromByteBuffer of the file src/main/java/org/HdrHistogram/AbstractHistogram.java. This manipulation of the argument numberOfSignificantValueDigits causes uncontrolled memory allocation. The attack can only be executed locally. The exploit has been published and may be used. The actual existence of this vulnerability is currently in question. This issue is disputed due to the potential lack of crossing of security boundaries and the pre-requisites for a successful attack.
Published: 2026-07-04
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A’s AbstractHistogram.decodeFromByteBuffer, where an attacker can supply an excessively large numberOfSignificantValueDigits value, leading to uncontrolled memory allocation and potential denial of service. The issue is classified under CWE‑400 (Uncontrolled Resource Consumption), CWE‑770 (Memory Allocation in Improper Order), and CWE‑789 (Out‑of‑Bounds Array Access). The impact does not affect confidentiality or integrity but can exhaust system resources if the vulnerable method is invoked by malicious or misconfigured local code.

Affected Systems

The affected product is the HdrHistogram library, with versions up to and including 2.2.2. The vulnerability is present in every build of the library up to the stated version and involves the org.HdrHistogram.AbstractHistogram class in the src/main/java/org/HdrHistogram/AbstractHistogram.java file.

Risk and Exploitability

The CVSS score of 4.8 indicates moderate severity. The EPSS score is very low (<1%), which suggests an extremely low probability of exploitation. The consensus is that the issue is not listed in CISA’s KEV catalog. The exploit has been published and may be used; however, the attack vector remains local, requiring the attacker to have local code execution on the same host where the vulnerable method runs.

Generated by OpenCVE AI on July 22, 2026 at 13:00 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to a HdrHistogram release newer than 2.2.2 where the issue is fixed, if such a release exists.
  • If an upgrade is impossible, add input validation to enforce a safe maximum value for numberOfSignificantValueDigits before calling decodeFromByteBuffer, preventing the allocation of maliciously large buffers.
  • Restrict or sandbox local processes that could invoke the vulnerable method, ensuring only trusted code can call decodeFromByteBuffer.

Generated by OpenCVE AI on July 22, 2026 at 13:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 16 Jul 2026 08:00:00 +0000

Type Values Removed Values Added
Description A flaw has been found in HdrHistogram up to 2.2.2. This affects the function org.HdrHistogram.AbstractHistogram.decodeFromByteBuffer of the file src/main/java/org/HdrHistogram/AbstractHistogram.java. This manipulation of the argument numberOfSignificantValueDigits causes uncontrolled memory allocation. The attack can only be executed locally. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet. A flaw has been found in HdrHistogram up to 2.2.2. This affects the function org.HdrHistogram.AbstractHistogram.decodeFromByteBuffer of the file src/main/java/org/HdrHistogram/AbstractHistogram.java. This manipulation of the argument numberOfSignificantValueDigits causes uncontrolled memory allocation. The attack can only be executed locally. The exploit has been published and may be used. The actual existence of this vulnerability is currently in question. This issue is disputed due to the potential lack of crossing of security boundaries and the pre-requisites for a successful attack.

Tue, 07 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-770
References
Metrics threat_severity

None

 threat_severity

Low

Mon, 06 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 04 Jul 2026 23:45:00 +0000

Type Values Removed Values Added
Description A flaw has been found in HdrHistogram up to 2.2.2. This affects the function org.HdrHistogram.AbstractHistogram.decodeFromByteBuffer of the file src/main/java/org/HdrHistogram/AbstractHistogram.java. This manipulation of the argument numberOfSignificantValueDigits causes uncontrolled memory allocation. The attack can only be executed locally. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Title HdrHistogram AbstractHistogram.java memory allocation
First Time appeared Hdrhistogram
Hdrhistogram hdrhistogram
Weaknesses CWE-400
CWE-789
CPEs cpe:2.3:a:hdrhistogram:hdrhistogram:*:*:*:*:*:*:*:*
Vendors & Products Hdrhistogram
Hdrhistogram hdrhistogram
References
Metrics cvssV2_0

{'score': 1.7, 'vector': 'AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 3.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Hdrhistogram Hdrhistogram
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-16T07:18:23.164Z

Reserved: 2026-07-04T04:39:58.430Z

Link: CVE-2026-14684

cve-icon Vulnrichment

Updated: 2026-07-06T16:36:15.226Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Low

Publid Date: 2026-07-04T23:30:10Z

Links: CVE-2026-14684 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-07-22T13:15:12Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-770

    Allocation of Resources Without Limits or Throttling

  • CWE-789

    Memory Allocation with Excessive Size Value