# CVE-2026-122096: Apache DataSketches Java uncontrolled resource consumption in sketch deserialization

Source: https://junglewise.ai/threats/cve-2026-122096-uncontrolled-resource-consumption-vulnerability-in-the-sketch  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-122096 · Severity: info · Published 2026-11-11

Apache DataSketches is a Java library used for approximate data structures and algorithms. Several deserializers in the library trusted unvalidated sizes in serialized sketch data, allowing a small crafted input to cause excessive memory allocation leading to application crashes, or to trigger infinite loops during deserialization. Only applications deserializing sketches from untrusted sources face risk.

Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-122096 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-122096 being exploited in the wild.

**How severe is CVE-2026-122096?** Informational severity, published 11 November 2026.

**Which products and versions are affected?** Apache DataSketches Java through 9.0.0.

**Is there a fix for CVE-2026-122096?** Yes: fixed in 9.1.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-122096 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-122096?** Check whether you run Apache DataSketches Java at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 9.1.0

## Technical details

The vulnerability involves two issues in sketch deserialization: (1) deserializers trust declared sizes and counts from serialized input without validation, leading to out-of-bounds memory allocation, and (2) FrequentLongsSketch.getInstance(String) can enter infinite loops when processing crafted input with invalid map capacity values. The fix validates map sizes and counts against minimum and maximum bounds before deserialization proceeds.

## Affected products

- Apache DataSketches Java through 9.0.0

## Timeline

- 2026-11-11: disclosed

## References

- [https://repo.maven.apache.org/maven2](https://repo.maven.apache.org/maven2)
- [https://github.com/apache/datasketches-java/pull/777](https://github.com/apache/datasketches-java/pull/777)