t‑digest versions 3.1 through 3.3 contain a flaw in the MergingDigest.fromBytes method, which fails to validate centroid mean values when deserializing. Attackers can inject serialized digests with NaN centroids that bypass validation checks. When the merge operation processes such a digest, the internal sort routine degrades from O(n log n) to O(n²), causing extreme processing delays that can exhaust CPU resources and bring the application to a halt.

This vulnerability affects installations of the tdunning t-digest library in versions 3.1 through 3.3. The library is widely used in Java applications that compute approximate histograms, quantiles, and streaming statistics, so any application that accepts externally supplied t‑digest data is at risk. The issue is limited to the library’s deserialization logic; there is no known code execution path.

The CVSS score of 8.7 indicates high severity, and although an EPSS score is not available, the risk of exploitation remains significant. The attack requires the ability to supply a maliciously crafted serialized digest; in many scenarios this can be achieved remotely if the application exposes an API or file upload that accepts t‑digest objects. The denial of service is achieved purely through resource exhaustion, without needing authentication, making it a potent vector for distributed or automated attacks. The vulnerability is not currently listed in CISA’s KEV catalog, but the high impact warrants immediate attention.