VDB
CVE-2026-14684
CVE-2026-14684
PUBLISHED
CVSS 4.8 MEDIUM
Reported by VulDB · Published July 4, 2026
A flaw has been found in HdrHistogram up to 2.2.2. This affects the function org.HdrHistogram.AbstractHistogram.decodeFromByteBuffer of the file src/main/java/org/HdrHistogram/AbstractHistogram.java. This manipulation of the argument numberOfSignificantValueDigits causes uncontrolled memory allocation. The attack can only be executed locally. The exploit has been published and may be used. The actual existence of this vulnerability is currently in question. This issue is disputed due to the potential lack of crossing of security boundaries and the pre-requisites for a successful attack.
Risk Scores
CVSS 4.0
4.8
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | HdrHistogram | 2.2.0, 2.2.1, 2.2.2 |
| n/a | HdrHistogram | 2.2.0, 2.2.1, 2.2.2 |
Timeline
- Jul 4, 2026 CVE Published
- Jul 5, 2026 EPSS Score
- Jul 5, 2026 Coalition ESS Score
- Jul 5, 2026 PoC Published
- Jul 7, 2026 Security Advisory
- Aug 24, 2026 EPSS Score
- Aug 27, 2026 EPSS Score
- Sep 16, 2026 EPSS Score
- Sep 24, 2026 EPSS Score
- Sep 30, 2026 EPSS Score
- Oct 9, 2026 EPSS Score
- Oct 14, 2026 EPSS Score
References
- VDB-376280 | HdrHistogram AbstractHistogram.java memory allocation vdb-entrytechnical-description
- VDB-376280 | CTI Indicators (IOB, IOC, IOA) signaturepermissions-required
- CVE-2026-14684 | CVE Analysis and Report third-party-advisory
- Submit #846754 | HdrHistogram 2.2.2 Denial of Service third-party-advisory
- exploitissue-tracking
- product