t-digest version 3.1 through 3.3 includes a flaw in the MergingDigest.fromBytes method, which fails to validate centroid mean values when deserializing. Attackers can inject serialized digests with NaN centroids that bypass validation checks. When the merge operation processes a digest containing these NaN values, the internal sort routine degrades from O(n log n) to O(n^2), resulting in extreme processing delays that can exhaust CPU resources and bring the application to a halt.

This vulnerability affects all installations of the t-digest library in the 3.1 to 3.3 range. The library is frequently used in Java applications that compute approximate histograms, quantiles, and streaming statistics, so any app that accepts externally supplied t-digest data is at risk. The issue is confined to the library’s deserialization logic; there is no known code execution path.

The CVSS score of 8.7 indicates high severity, and although an EPSS score is not available, the risk of exploitation remains significant. The attack requires the capability to supply a maliciously crafted serialized digest; in many scenarios this can be achieved remotely if the application exposes an API or file upload that accepts t-digest objects. The denial of service is achieved purely through resource exhaustion, without needing authentication, making it a potent vector for distributed or automated attacks. The vulnerability is not currently listed in CISA’s KEV catalog, but the high impact warrants immediate attention.