CVE-2026-122096 · Package
NO FIX YET · SEE WHAT TO DO
Several deserializers in Apache DataSketches Java trust sizes and counts in serialized input, so a small crafted input can force excessive memory allocation and an OutOfMemoryError. A crafted string passed to FrequentLongsSketch.getInstance(String) can also make deserialization or a later update loop indefinitely.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that deserialize sketches from untrusted sources are affected; the sources say that applications which only handle trusted sketch data are not. Look for any service that accepts serialized sketch input from users or other external parties.
Not affected if trusted-input-only
Who cares apache-datasketches, java
datasketches-java in pom.xml or build.gradle.9.1.0.Uncontrolled Resource Consumption vulnerability in the sketch deserialization of Apache DataSketches Java.
Several deserializers trusted sizes and counts declared in the serialized input. A small crafted input could make an application allocate an excessive amount of memory, leading to an OutOfMemoryError. A crafted string passed to FrequentLongsSketch.getInstance(String) could also make deserialization, or a later update, loop indefinitely. Only applications that deserialize sketches from untrusted sources are affected.
This issue affects Apache DataSketches Java: through 9.0.0.
Users are recommended to upgrade to version 9.1.0, which fixes the issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.