Executive brief
t-digest is a Java library used for efficient statistical calculations and quantile estimation on large datasets. A vulnerability in how it deserializes serialized digest data allows attackers to provide malformed input that causes the application to crash, disrupting service availability for any system relying on this library for data analysis operations.
Technical details
The vulnerability exists in the MergingDigest.fromBytes deserialization method in t-digest versions 3.1 through 3.3, which fails to properly validate the length and capacity fields read from serialized digest data. An attacker can craft a malicious serialized digest with inconsistent header field values to trigger either ArrayIndexOutOfBoundsException or NegativeArraySizeException during parsing, causing the parsing thread to abort. This is a remotely exploitable denial of service requiring only the ability to provide serialized data to the vulnerable deserialization method; no authentication or user interaction is required. No patch information is currently available in the advisory.
Affected products
- t-digest t-digest 3.1 through 3.3
Timeline
- 2026-09-10: disclosed