PT-2026-55742 · Unknown · Hdrhistogram

Sara11H · Published 2026-07-04 · Updated 2026-07-05 · CVE-2026-14684

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions HdrHistogram versions prior to 2.2.3

Description A flaw exists in the decodeFromByteBuffer() function within the org.HdrHistogram.AbstractHistogram class. This issue occurs when the numberOfSignificantValueDigits argument is manipulated, leading to uncontrolled memory allocation. This attack can only be executed locally.

Recommendations Update HdrHistogram to a version newer than 2.2.2. As a temporary workaround, restrict the use of the decodeFromByteBuffer() function to prevent uncontrolled memory allocation.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

CWE-789

Related Identifiers

CVE-2026-14684

Affected Products

Hdrhistogram

References · 9

• 🔥 https://github.com/HdrHistogram/HdrHistogram/issues/220 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-14684 · Security Note
• https://twitter.com/CVEnew/status/2073557063972860283 · Twitter Post
• https://vuldb.com/vuln/376280 · Note
• https://reddit.com/r/pwnhub/comments/1uo893g/a_flaw_has_been_found_in_hdrhistogram_up_to_222 · Reddit Post
• https://vuldb.com/cve/CVE-2026-14684 · Note
• https://vuldb.com/vuln/376280/cti · Note
• https://vuldb.com/submit/846754 · Note
• https://github.com/HdrHistogram/HdrHistogram · Note