{"id":"CVE-2026-123274","kind":"vulnerability","aliases":["CVE-2026-123274"],"related":[],"title":"Apache DataSketches C++: crafted KLL sketch corrupts heap memory on load","description":"Out-of-bounds Write vulnerability in Apache DataSketches C++. An\n  application that deserializes a KLL sketch from an untrusted source\n  can have heap memory corrupted by a crafted sketch, because the\n  serialized level boundaries were not validated.\n\n  This issue affects Apache DataSketches C++: 2.0.0 through 5.3.0.\n\n  Users are recommended to upgrade to version 5.3.1, which fixes the\n  issue.","summary":"Apache DataSketches C++ does not validate level boundaries when it deserializes a KLL sketch. A crafted sketch from an untrusted source can overwrite heap memory in the application that loads it.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Apache DataSketches C++","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["apache-datasketches","c++","data-processing","package"],"not_affected_if":["no-kll-deserialization","trusted-input-only"],"how_to_check":"- Check the installed version of Apache DataSketches C++ against the affected range `2.0.0` through `5.3.0`.\n- Search your code for calls that deserialize KLL sketches from data you do not control, such as network input or uploaded files.","fix":"- Apache DataSketches C++: upgrade to `5.3.1`.","status":"open","published_at":"2026-11-13T11:17:16+00:00","first_seen_at":"2026-11-13T11:44:16+00:00","triaged_at":"2026-11-13T11:44:34+00:00","updated_at":"2026-11-13T11:44:34+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T11:44:34Z","model":"claude-haiku-5-5","output":{"fix":"- Apache DataSketches C++: upgrade to `5.3.1`.","reach":"unknown","title":"Apache DataSketches C++: crafted KLL sketch corrupts heap memory on load","impact":"high","summary":"Apache DataSketches C++ does not validate level boundaries when it deserializes a KLL sketch. A crafted sketch from an untrusted source can overwrite heap memory in the application that loads it.","audience":"developers","category":"package","nicknames":[],"who_cares":["c++","data-processing","apache-datasketches"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"crafted sketch corrupts heap memory, possibly enabling code execution","analyst_note":"","how_to_check":"- Check the installed version of Apache DataSketches C++ against the affected range `2.0.0` through `5.3.0`.\n- Search your code for calls that deserialize KLL sketches from data you do not control, such as network input or uploaded files.","plain_action":"","product_name":"Apache DataSketches C++","needs_analyst":false,"not_affected_if":["trusted-input-only","no-kll-deserialization"],"who_is_affected":"Applications that call the KLL sketch deserializer on data from an untrusted source are exposed. Applications that only build sketches locally or deserialize only data they produced are not exposed by this flaw. The sources do not describe further configuration.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000731,"input_tokens":4611,"output_tokens":539,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-123274':14A,17A '-2026':13A,16A '2.0.0':103C '5.3.0':105C '5.3.1':113C 'affect':99C 'apach':1A,22B,29B,66C,100C 'apache':18A 'apache-datasketch':21B 'applic':56B,70C 'bound':62C 'boundari':36B,93C 'c':3A,20A,24B,31B,68C,102C 'corrupt':7A,84C 'craft':4A,44B,87C 'cve':12A,15A 'data':26B 'data-process':25B 'datasketch':2A,23B,30B,67C,101C 'datasketches':19A 'deseri':39B,72C 'fix':115C 'heap':8A,52B,82C 'issu':98C,117C 'kll':5A,41B,74C 'level':35B,92C 'load':11A,58B 'memori':9A,53B,83C 'out-of-bound':59C 'overwrit':51B 'packag':28B 'process':27B 'recommend':108C 'serial':91C 'sketch':6A,42B,45B,75C,88C 'sourc':49B,79C 'untrust':48B,78C 'upgrad':110C 'user':106C 'valid':34B,96C 'version':112C 'vulner':64C 'write':63C","nicknames":[],"mitigations":[],"who_affected":"Applications that call the KLL sketch deserializer on data from an untrusted source are exposed. Applications that only build sketches locally or deserialize only data they produced are not exposed by this flaw. The sources do not describe further configuration.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["apachedatasketchesc","datasketchesc"],"ptokens":["apache","datasketches"],"labels":["apachedatasketches","c","dataprocessing","high","package","vendor"],"campaign_type":null,"search_a":"'-123274':14A,17A '-2026':13A,16A 'apach':1A 'apache':18A 'c':3A,20A 'corrupt':7A 'craft':4A 'cve':12A,15A 'datasketch':2A 'datasketches':19A 'heap':8A 'kll':5A 'load':11A 'memori':9A 'sketch':6A","search_b":"'apach':22B,29B 'apache-datasketch':21B 'applic':56B 'boundari':36B 'c':24B,31B 'craft':44B 'data':26B 'data-process':25B 'datasketch':23B,30B 'deseri':39B 'heap':52B 'kll':41B 'level':35B 'load':58B 'memori':53B 'overwrit':51B 'packag':28B 'process':27B 'sketch':42B,45B 'sourc':49B 'untrust':48B 'valid':34B","search_c":"'2.0.0':103C '5.3.0':105C '5.3.1':113C 'affect':99C 'apach':66C,100C 'applic':70C 'bound':62C 'boundari':93C 'c':68C,102C 'corrupt':84C 'craft':87C 'datasketch':67C,101C 'deseri':72C 'fix':115C 'heap':82C 'issu':98C,117C 'kll':74C 'level':92C 'memori':83C 'out-of-bound':59C 'recommend':108C 'serial':91C 'sketch':75C,88C 'sourc':79C 'untrust':78C 'upgrad':110C 'user':106C 'valid':96C 'version':112C 'vulner':64C 'write':63C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T11:17:16+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123274","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123274","severity":null,"published_at":"2026-11-13T11:17:16+00:00","modified_at":"2026-11-13T11:17:16+00:00","first_seen_at":"2026-11-13T11:44:16+00:00","fetched_at":"2026-11-13T11:44:16+00:00","note":null}],"documents":[{"id":145724,"url":"https://github.com/apache/datasketches-cpp/commit/bb86d439db494e3d362e54cc4f83481893974335","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":145725,"url":"https://github.com/apache/datasketches-cpp/releases/tag/5.3.1","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}