{"id":"CVE-2026-122096","kind":"vulnerability","aliases":["CVE-2026-122096"],"related":[],"title":"Apache DataSketches Java: crafted sketch input exhausts memory and hangs","description":"Uncontrolled Resource Consumption vulnerability in the sketch deserialization of Apache DataSketches Java.\n\n\n\nSeveral deserializers trusted sizes and counts declared in the serialized input. A small crafted input could make an application allocate an excessive amount of memory, leading to an OutOfMemoryError. A crafted string passed to FrequentLongsSketch.getInstance(String) could also make deserialization, or a later update, loop indefinitely. Only applications that deserialize sketches from untrusted sources are affected.\n\n\n\nThis issue affects Apache DataSketches Java: through 9.0.0.\n\n\n\nUsers are recommended to upgrade to version 9.1.0, which fixes the issue.","summary":"Several deserializers in Apache DataSketches Java trust sizes and counts in serialized input, so a small crafted input can force excessive memory allocation and an OutOfMemoryError. A crafted string passed to FrequentLongsSketch.getInstance(String) can also make deserialization or a later update loop indefinitely.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-datasketches","java","package"],"not_affected_if":["trusted-input-only"],"how_to_check":"- Check the DataSketches version in the project's build file, for example `datasketches-java` in pom.xml or build.gradle.\n- Look for code that calls deserialization on sketches received from untrusted sources, including FrequentLongsSketch.getInstance(String).","fix":"- Apache DataSketches Java: upgrade to `9.1.0`.","status":"open","published_at":"2026-11-11T13:17:17+00:00","first_seen_at":"2026-11-11T13:27:12+00:00","triaged_at":"2026-11-11T13:30:04+00:00","updated_at":"2026-11-11T13:30:04+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-11T13:30:04Z","model":"claude-haiku-5-5","output":{"fix":"- Apache DataSketches Java: upgrade to `9.1.0`.","reach":"unknown","title":"Apache DataSketches Java: crafted sketch input exhausts memory and hangs","impact":"medium","summary":"Several deserializers in Apache DataSketches Java trust sizes and counts in serialized input, so a small crafted input can force excessive memory allocation and an OutOfMemoryError. A crafted string passed to FrequentLongsSketch.getInstance(String) can also make deserialization or a later update loop indefinitely.","audience":"developers","category":"package","nicknames":[],"who_cares":["java","apache-datasketches"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"Memory exhaustion or endless loop from a small crafted input","analyst_note":"","how_to_check":"- Check the DataSketches version in the project's build file, for example `datasketches-java` in pom.xml or build.gradle.\n- Look for code that calls deserialization on sketches received from untrusted sources, including FrequentLongsSketch.getInstance(String).","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["trusted-input-only"],"who_is_affected":"Applications that deserialize sketches from untrusted sources are affected; the sources say that applications which only handle trusted sketch data are not. Look for any service that accepts serialized sketch input from users or other external parties.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000742,"input_tokens":4684,"output_tokens":547,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-122096':13A,16A '-2026':12A,15A '9.0.0':140C '9.1.0':148C 'affect':132C,135C 'alloc':44B,96C 'also':56B,114C 'amount':99C 'apach':1A,18B,25B,74C,136C 'apache-datasketch':17B 'applic':95C,124C 'consumpt':67C 'could':92C,113C 'count':31B,82C 'craft':4A,38B,49B,90C,107C 'cve':11A,14A 'datasketch':2A,19B,26B,75C,137C 'declar':83C 'deseri':23B,58B,72C,78C,116C,126C 'excess':42B,98C 'exhaust':7A 'fix':150C 'forc':41B 'frequentlongssketch.getinstance':53B,111C 'hang':10A 'indefinit':64B,122C 'input':6A,34B,39B,87C,91C 'issu':134C,152C 'java':3A,20B,27B,76C,138C 'later':61B,119C 'lead':102C 'loop':63B,121C 'make':57B,93C,115C 'memori':8A,43B,101C 'outofmemoryerror':47B,105C 'packag':21B 'pass':51B,109C 'recommend':143C 'resourc':66C 'serial':33B,86C 'sever':22B,77C 'size':29B,80C 'sketch':5A,71C,127C 'small':37B,89C 'sourc':130C 'string':50B,54B,108C,112C 'trust':28B,79C 'uncontrol':65C 'untrust':129C 'updat':62B,120C 'upgrad':145C 'user':141C 'version':147C 'vulner':68C","nicknames":[],"mitigations":[],"who_affected":"Applications that deserialize sketches from untrusted sources are affected; the sources say that applications which only handle trusted sketch data are not. Look for any service that accepts serialized sketch input from users or other external parties.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apachedatasketches","java","package","unknown"],"campaign_type":null,"search_a":"'-122096':13A,16A '-2026':12A,15A 'apach':1A 'craft':4A 'cve':11A,14A 'datasketch':2A 'exhaust':7A 'hang':10A 'input':6A 'java':3A 'memori':8A 'sketch':5A","search_b":"'alloc':44B 'also':56B 'apach':18B,25B 'apache-datasketch':17B 'count':31B 'craft':38B,49B 'datasketch':19B,26B 'deseri':23B,58B 'excess':42B 'forc':41B 'frequentlongssketch.getinstance':53B 'indefinit':64B 'input':34B,39B 'java':20B,27B 'later':61B 'loop':63B 'make':57B 'memori':43B 'outofmemoryerror':47B 'packag':21B 'pass':51B 'serial':33B 'sever':22B 'size':29B 'small':37B 'string':50B,54B 'trust':28B 'updat':62B","search_c":"'9.0.0':140C '9.1.0':148C 'affect':132C,135C 'alloc':96C 'also':114C 'amount':99C 'apach':74C,136C 'applic':95C,124C 'consumpt':67C 'could':92C,113C 'count':82C 'craft':90C,107C 'datasketch':75C,137C 'declar':83C 'deseri':72C,78C,116C,126C 'excess':98C 'fix':150C 'frequentlongssketch.getinstance':111C 'indefinit':122C 'input':87C,91C 'issu':134C,152C 'java':76C,138C 'later':119C 'lead':102C 'loop':121C 'make':93C,115C 'memori':101C 'outofmemoryerror':105C 'pass':109C 'recommend':143C 'resourc':66C 'serial':86C 'sever':77C 'size':80C 'sketch':71C,127C 'small':89C 'sourc':130C 'string':108C,112C 'trust':79C 'uncontrol':65C 'untrust':129C 'updat':120C 'upgrad':145C 'user':141C 'version':147C 'vulner':68C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T13:17:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122096","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122096","severity":null,"published_at":"2026-11-11T13:17:17+00:00","modified_at":"2026-11-11T13:17:17+00:00","first_seen_at":"2026-11-11T13:27:12+00:00","fetched_at":"2026-11-11T13:27:12+00:00","note":null}],"documents":[{"id":125671,"url":"https://github.com/apache/datasketches-java/releases/tag/9.1.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}