{"id":"CVE-2026-87822","state":"PUBLISHED","title":"t-digest 3.1 through 3.3 Denial of Service via NaN Centroid Means in MergingDigest.fromBytes","description":"t-digest versions 3.1 through 3.3 fail to validate centroid means during deserialization in MergingDigest.fromBytes, allowing attackers to inject NaN values that bypass validation checks. Attackers can craft malicious serialized digests containing NaN centroids that degrade sorting performance from O(n log n) to O(n squared), causing severe processing delays during merge operations.","publishedAt":"2026-09-09T14:32:42.726Z","updatedAt":"2026-09-10T14:57:02.770Z","severity":{"score":8.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["tdunning t-digest"],"affected":[{"vendor":"tdunning","product":"t-digest","packageURL":"pkg:maven/com.tdunning/t-digest","defaultStatus":"unaffected","versions":[{"version":"3.1","status":"affected","lessThanOrEqual":"3.3","versionType":"custom"}],"collectionURL":"https://repo1.maven.org/maven2/com/tdunning/t-digest/","repo":"https://github.com/tdunning/t-digest"}],"references":["https://github.com/tdunning/t-digest/issues/229","https://github.com/tdunning/t-digest/blob/8d5c1523c3d46925e9b3979a8d63c0b9d004ed1c/core/src/main/java/com/tdunning/math/stats/MergingDigest.java","https://github.com/tdunning/t-digest/blob/8d5c1523c3d46925e9b3979a8d63c0b9d004ed1c/core/src/main/java/com/tdunning/math/stats/Sort.java","https://github.com/tdunning/t-digest","https://www.vulncheck.com/advisories/t-digest-3.1-through-3.3-denial-of-service-via-nan-centroid-means-in-mergingdigest-frombytes"],"weaknesses":["CWE-407"],"ingestedAt":"2026-10-29T20:13:26.108Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/87xxx/CVE-2026-87822.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-87822","state":"PUBLISHED","datePublished":"2026-09-09T14:32:42.726Z","dateUpdated":"2026-09-10T14:57:02.770Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-09-09T10:32:34.110Z"},"containers":{"cna":{"title":"t-digest 3.1 through 3.3 Denial of Service via NaN Centroid Means in MergingDigest.fromBytes","descriptions":[{"lang":"en","value":"t-digest versions 3.1 through 3.3 fail to validate centroid means during deserialization in MergingDigest.fromBytes, allowing attackers to inject NaN values that bypass validation checks. Attackers can craft malicious serialized digests containing NaN centroids that degrade sorting performance from O(n log n) to O(n squared), causing severe processing delays during merge operations."}],"affected":[{"vendor":"tdunning","product":"t-digest","packageURL":"pkg:maven/com.tdunning/t-digest","defaultStatus":"unaffected","versions":[{"version":"3.1","status":"affected","lessThanOrEqual":"3.3","versionType":"custom"}],"collectionURL":"https://repo1.maven.org/maven2/com/tdunning/t-digest/","repo":"https://github.com/tdunning/t-digest"}],"references":[{"url":"https://github.com/tdunning/t-digest/issues/229","tags":["issue-tracking"],"name":"tdunning/t-digest issue #229"},{"url":"https://github.com/tdunning/t-digest/blob/8d5c1523c3d46925e9b3979a8d63c0b9d004ed1c/core/src/main/java/com/tdunning/math/stats/MergingDigest.java","tags":["technical-description"],"name":"fromBytes writing centroid means with no NaN check at the 3.3 release commit"},{"url":"https://github.com/tdunning/t-digest/blob/8d5c1523c3d46925e9b3979a8d63c0b9d004ed1c/core/src/main/java/com/tdunning/math/stats/Sort.java","tags":["technical-description"],"name":"stableQuickSort three-way partition that degrades on NaN at the 3.3 release commit"},{"url":"https://github.com/tdunning/t-digest","tags":["product"]},{"url":"https://www.vulncheck.com/advisories/t-digest-3.1-through-3.3-denial-of-service-via-nan-centroid-means-in-mergingdigest-frombytes","name":"VulnCheck Advisory: t-digest 3.1 through 3.3 Denial of Service via NaN Centroid Means in MergingDigest.fromBytes","tags":["third-party-advisory"]}],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH"}},{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-407","lang":"en","description":"Inefficient Algorithmic Complexity","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-09-09T14:32:42.726Z"},"datePublic":"2026-08-24T00:00:00.000Z","credits":[{"lang":"en","value":"Yu Bao, PayPal Cyber Security Team","type":"finder"}],"x_generator":{"engine":"vulncheck-endgame"},"source":{"discovery":"EXTERNAL"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-10T14:22:28.894428Z","id":"CVE-2026-87822","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-10T14:57:02.770Z"}}]}}}