Executive brief
HdrHistogram is a Java library used for high-resolution tracking of value distributions, often used in performance monitoring. A flaw in how the library handles specific numerical inputs (NaN) allows invalid data to bypass safety checks. This can lead to silent data corruption in performance metrics, potentially causing organizations to rely on inaccurate system health data.
Technical details
An incorrect comparison vulnerability (CWE-697) exists in HdrHistogram versions up to 2.2.2 within the `org.HdrHistogram.DoubleHistogram.recordValue` function in `DoubleHistogram.java`. The vulnerability stems from a failure to properly validate 'NaN' (Not-a-Number) values during range checks. An attacker with local access or the ability to influence recorded values can bypass these checks, resulting in silent data corruption within the histogram. While an issue report was submitted to the maintainers, no official patch has been released at the time of disclosure.
Affected products
- HdrHistogram HdrHistogram up to 2.2.2
Timeline
- 2026-07-05: disclosed: Public disclosure of the vulnerability and CVE assignment.
- 2026-07-05: advisory: NVD publication date.