{"id":"CVE-2026-122096","state":"PUBLISHED","title":"Apache DataSketches Java: Uncontrolled resource consumption when deserializing crafted sketch images","description":"Uncontrolled Resource Consumption vulnerability in the sketch deserialization of Apache DataSketches Java.\n\n\n\nSeveral deserializers trusted sizes and counts declared in the serialized input. A small crafted input could make an application allocate an excessive amount of memory, leading to an OutOfMemoryError. A crafted string passed to FrequentLongsSketch.getInstance(String) could also make deserialization, or a later update, loop indefinitely. Only applications that deserialize sketches from untrusted sources are affected.\n\n\n\nThis issue affects Apache DataSketches Java: through 9.0.0.\n\n\n\nUsers are recommended to upgrade to version 9.1.0, which fixes the issue.","publishedAt":"2026-11-11T12:13:53.275Z","updatedAt":"2026-11-11T13:09:23.609Z","severity":null,"assigner":"apache","products":["Apache Software Foundation Apache DataSketches Java"],"affected":[{"vendor":"Apache Software Foundation","product":"Apache DataSketches Java","packageName":"org.apache.datasketches:datasketches-java","packageURL":"pkg:maven/org.apache.datasketches/datasketches-java","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"9.0.0","versionType":"semver"}],"collectionURL":"https://repo.maven.apache.org/maven2"}],"references":["https://github.com/apache/datasketches-java/releases/tag/9.1.0","https://github.com/apache/datasketches-java/pull/777","https://github.com/apache/datasketches-java/pull/783","https://lists.apache.org/thread/9wd7ngmho7hm8x74sq1p2fp1xgjd8kt6","http://www.openwall.com/lists/oss-security/2026/11/10/29"],"weaknesses":["CWE-400","CWE-789","CWE-835"],"ingestedAt":"2026-11-11T13:18:07.355Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/122xxx/CVE-2026-122096.json","commit":"8172215bb72d27e66d10350cd4b30840a4dca899","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-122096","state":"PUBLISHED","datePublished":"2026-11-11T12:13:53.275Z","dateUpdated":"2026-11-11T13:09:23.609Z","assignerShortName":"apache","assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","dateReserved":"2026-11-04T17:30:04.549Z"},"containers":{"cna":{"title":"Apache DataSketches Java: Uncontrolled resource consumption when deserializing crafted sketch images","descriptions":[{"lang":"en","value":"Uncontrolled Resource Consumption vulnerability in the sketch deserialization of Apache DataSketches Java.\n\n\n\nSeveral deserializers trusted sizes and counts declared in the serialized input. A small crafted input could make an application allocate an excessive amount of memory, leading to an OutOfMemoryError. A crafted string passed to FrequentLongsSketch.getInstance(String) could also make deserialization, or a later update, loop indefinitely. Only applications that deserialize sketches from untrusted sources are affected.\n\n\n\nThis issue affects Apache DataSketches Java: through 9.0.0.\n\n\n\nUsers are recommended to upgrade to version 9.1.0, which fixes the issue."}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache DataSketches Java","packageName":"org.apache.datasketches:datasketches-java","packageURL":"pkg:maven/org.apache.datasketches/datasketches-java","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"9.0.0","versionType":"semver"}],"collectionURL":"https://repo.maven.apache.org/maven2"}],"references":[{"url":"https://github.com/apache/datasketches-java/releases/tag/9.1.0","tags":["release-notes"]},{"url":"https://github.com/apache/datasketches-java/pull/777","tags":["patch"]},{"url":"https://github.com/apache/datasketches-java/pull/783","tags":["patch"]},{"url":"https://lists.apache.org/thread/9wd7ngmho7hm8x74sq1p2fp1xgjd8kt6","tags":["vendor-advisory"]}],"metrics":[{"other":{"type":"Textual description of severity","content":{"text":"low"}},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-400","description":"CWE-400","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-789","description":"CWE-789 Memory allocation with excessive size value","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-835","description":"CWE-835 Loop with unreachable exit condition ('infinite loop')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"apache","orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","dateUpdated":"2026-11-11T12:13:53.275Z"},"source":{"discovery":"EXTERNAL"},"credits":[{"lang":"en","value":"Jaideep Pyne","type":"finder"}],"x_generator":{"engine":"Vulnogram 1.0.3"}},"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/11/10/29"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2026-11-11T13:09:23.609Z"}}]}}}