Executive brief
HdrHistogram is a Java library used for recording and analyzing high-resolution data distributions, often used in performance monitoring. A flaw in how the library handles compressed data allows a local attacker to trigger excessive memory consumption. This can lead to an Out-of-Memory (OOM) error, causing the application using the library to crash or become unresponsive.
Technical details
A vulnerability exists in HdrHistogram up to version 2.2.2 within the 'decodeFromCompressedByteBuffer' function of 'AbstractHistogram.java'. The issue stems from uncontrolled memory allocation (CWE-789/CWE-400) when processing the 'lengthOfCompressedContents' argument. A local attacker can provide a manipulated length value to force the application to allocate an excessive amount of memory, leading to an Out-of-Memory (OOM) condition and denial-of-service. While the project was notified via an issue report, no official patch has been confirmed at the time of this advisory.
Affected products
- HdrHistogram HdrHistogram Up to 2.2.2
Timeline
- 2026-07-04: disclosed: Vulnerability published via VulDB/NVD
- 2026-07-04: advisory