Description
A vulnerability has been found in HdrHistogram up to 2.2.2. This vulnerability affects the function recordValueWithCount of the file src/main/java/org/HdrHistogram/AbstractHistogram.java of the component AbstractHistogram. Such manipulation of the argument Count leads to state issue. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. The existence of this vulnerability is still disputed at present. This issue is disputed due to the potential lack of crossing of security boundaries and the pre-requisites for a successful attack.
Published: 2026-07-04
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in HdrHistogram’s recordValueWithCount method allows an attacker to supply a malicious count value that corrupts the histogram’s internal state. The resulting state fault manifests as inaccurate statistics or unexpected failures in downstream components that rely on the data. The weakness is classified as CWE‑371,

Affected Systems

All releases of HdrHistogram up to and including version 2.2.2 are affected. The vulnerability is fixed in future releases, so any deployment that incorporates an earlier version remains susceptible until the flaw is patched.

Risk and Exploitability

The CVSS score of 4.8 indicates low severity, and the EPSS score of < 1% shows a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog and can only be abused from a local environment. Thus the risk is confined to local execution.

Generated by OpenCVE AI on July 22, 2026 at 13:00 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade HdrHistogram to a version that contains the fix; monitor the project’s release notes for an update.
  • Validate the count parameter before calling recordValueWithCount, ensuring it is non‑negative and falls within expected bounds to prevent state corruption.
  • Monitor histogram outputs and application logs for abnormal values; consider isolating or sandboxing processes that use the library to contain potential impact.

Generated by OpenCVE AI on July 22, 2026 at 13:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 16 Jul 2026 08:00:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in HdrHistogram up to 2.2.2. This vulnerability affects the function recordValueWithCount of the file src/main/java/org/HdrHistogram/AbstractHistogram.java of the component AbstractHistogram. Such manipulation of the argument Count leads to state issue. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet. A vulnerability has been found in HdrHistogram up to 2.2.2. This vulnerability affects the function recordValueWithCount of the file src/main/java/org/HdrHistogram/AbstractHistogram.java of the component AbstractHistogram. Such manipulation of the argument Count leads to state issue. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. The existence of this vulnerability is still disputed at present. This issue is disputed due to the potential lack of crossing of security boundaries and the pre-requisites for a successful attack.

Wed, 15 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-1284
References
Metrics threat_severity

None

 threat_severity

Low

Mon, 06 Jul 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 05 Jul 2026 00:00:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in HdrHistogram up to 2.2.2. This vulnerability affects the function recordValueWithCount of the file src/main/java/org/HdrHistogram/AbstractHistogram.java of the component AbstractHistogram. Such manipulation of the argument Count leads to state issue. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Title HdrHistogram AbstractHistogram AbstractHistogram.java recordValueWithCount state issue
First Time appeared Hdrhistogram
Hdrhistogram hdrhistogram
Weaknesses CWE-371
CPEs cpe:2.3:a:hdrhistogram:hdrhistogram:*:*:*:*:*:*:*:*
Vendors & Products Hdrhistogram
Hdrhistogram hdrhistogram
References
Metrics cvssV2_0

{'score': 1.7, 'vector': 'AV:L/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 3.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Hdrhistogram Hdrhistogram
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-16T07:18:02.162Z

Reserved: 2026-07-04T04:40:13.250Z

Link: CVE-2026-14685

cve-icon Vulnrichment

Updated: 2026-07-06T16:22:08.156Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Low

Publid Date: 2026-07-04T23:45:08Z

Links: CVE-2026-14685 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-07-22T13:00:12Z

Weaknesses