A flaw in t-digest 3.1 through 3.3 allows attackers to supply a serialized digest in which the length and capacity values in the header do not match the actual payload. The deserialize routine fails to verify these fields and will throw an ArrayIndexOutOfBoundsException or NegativeArraySizeException, which terminates the parsing thread and results in a denial of service to any component that processes user‑supplied digests.

The vulnerable product is the t-digest library from tdunning. Versions 3.1, 3.2, and 3.3 are affected; no older or later releases are mentioned as fixed.

The CVSS score of 8.7 indicates a high severity denial of service risk. The EPSS score is not available, so the likelihood of exploitation is unknown at present, and the vulnerability is not listed in CISA KEV. Based on the description, it is inferred that the attack does not require elevated privileges; any attacker who can provide a maliciously serialized digest to a component that calls MergingDigest.fromBytes can trigger repeated crashes of the parsing thread, impairing availability.