# CVE-2026-14685: HdrHistogram state manipulation in recordValueWithCount

Source: https://junglewise.ai/threats/cve-2026-14685-hdrhistogram-state-manipulation-in-recordvaluewithcount  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-05. Updated: 2026-07-05  
License: CC BY 4.0 with a link back

CVE-2026-14685 · Severity: low · CVSS 3.3 · Published 2026-07-05

HdrHistogram is a Java library used by developers to track and analyze the distribution of values, such as application latency. A flaw in the library allows a local user to provide negative count values, which can corrupt the internal state of the histogram. This could lead to incorrect data reporting or unexpected behavior in applications that rely on this library for performance monitoring.

Technologies: [HdrHistogram](https://junglewise.ai/threats/technologies/hdrhistogram). Vendors: [HdrHistogram](https://junglewise.ai/threats/vendors/hdrhistogram).

## Quick answers

**Is CVE-2026-14685 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14685 being exploited in the wild.

**How severe is CVE-2026-14685?** Low severity, with a CVSS score of 3.3, published 5 July 2026.

**Which products and versions are affected?** HdrHistogram Up to 2.2.2.

**Is there a fix for CVE-2026-14685?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-14685 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-14685?** Check whether you run HdrHistogram at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A state manipulation vulnerability (CWE-371) exists in HdrHistogram versions up to 2.2.2 within the recordValueWithCount function of AbstractHistogram.java. The root cause is the lack of validation for the 'count' argument, which allows the function to accept negative values. An attacker with local access to the environment where the library is running can exploit this to manipulate the internal state of the histogram. While the impact is limited to integrity (incorrect data state), the exploit has been disclosed publicly. As of the advisory date, the project maintainers have not yet released a patch.

## Affected products

- HdrHistogram HdrHistogram Up to 2.2.2

## Timeline

- 2026-07-05: advisory: NVD publication date
- 2026-07-05: disclosed: Public disclosure of the exploit

## References

- [https://github.com/HdrHistogram/HdrHistogram/](https://github.com/HdrHistogram/HdrHistogram/)
- [https://github.com/HdrHistogram/HdrHistogram/issues/221](https://github.com/HdrHistogram/HdrHistogram/issues/221)
- [https://vuldb.com/cve/CVE-2026-14685](https://vuldb.com/cve/CVE-2026-14685)
- [https://vuldb.com/submit/846761](https://vuldb.com/submit/846761)
- [https://vuldb.com/vuln/376281](https://vuldb.com/vuln/376281)
- [https://vuldb.com/vuln/376281/cti](https://vuldb.com/vuln/376281/cti)

## Related threats

- [HdrHistogram incorrect comparison in DoubleHistogram recordValue](https://junglewise.ai/threats/cve-2026-14686-hdrhistogram-incorrect-comparison-in-doublehistogram-recordvalue)
- [HdrHistogram uncontrolled memory allocation in AbstractHistogram](https://junglewise.ai/threats/cve-2026-14684-hdrhistogram-uncontrolled-memory-allocation-in-abstracthistogram)
- [HdrHistogram uncontrolled memory allocation in AbstractHistogram](https://junglewise.ai/threats/cve-2026-14683-hdrhistogram-uncontrolled-memory-allocation-in-abstracthistogram)