{"id":"CVE-2026-123338","kind":"vulnerability","aliases":["CVE-2026-123338"],"related":[],"title":"Apache DataSketches C++: crafted REQ sketch corrupts heap memory on load","description":"Out-of-bounds Write vulnerability in Apache DataSketches C++. An\n  application that deserializes a REQ sketch from an untrusted source\n  can have heap memory corrupted by a crafted sketch, because the\n  serialized compactor headers were not validated.\n\n  This issue affects Apache DataSketches C++: from 3.0.0 through 5.3.0.\n\n  Users are recommended to upgrade to version 5.3.1, which fixes the\n  issue.","summary":"Apache DataSketches C++ does not validate serialized compactor headers when it deserializes a REQ sketch. An application that loads a crafted sketch from an untrusted source can have heap memory corrupted, which can lead to code execution.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-datasketches","c++","data-processing","package"],"not_affected_if":["no-req-sketch-deserialization","trusted-input-only"],"how_to_check":"- Check the installed DataSketches C++ version against the affected range (`3.0.0` through `5.3.0`).\n- Search your code for calls that deserialize REQ sketches (`req_sketch`) from data that comes from outside your trust boundary.","fix":"- Upgrade Apache DataSketches C++ to `5.3.1`.","status":"open","published_at":"2026-11-13T11:17:16+00:00","first_seen_at":"2026-11-13T11:44:16+00:00","triaged_at":"2026-11-13T11:44:34+00:00","updated_at":"2026-11-13T11:44:34+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T11:44:34Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache DataSketches C++ to `5.3.1`.","reach":"unknown","title":"Apache DataSketches C++: crafted REQ sketch corrupts heap memory on load","impact":"high","summary":"Apache DataSketches C++ does not validate serialized compactor headers when it deserializes a REQ sketch. An application that loads a crafted sketch from an untrusted source can have heap memory corrupted, which can lead to code execution.","audience":"developers","category":"package","nicknames":[],"who_cares":["c++","apache-datasketches","data-processing"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"crafted sketch corrupts heap memory, possibly running code","analyst_note":"Confirm the CVSS score and whether heap corruption is reachable from the library's public deserialization API; check the linked patch and release notes for the 5.3.1 fix.","how_to_check":"- Check the installed DataSketches C++ version against the affected range (`3.0.0` through `5.3.0`).\n- Search your code for calls that deserialize REQ sketches (`req_sketch`) from data that comes from outside your trust boundary.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["trusted-input-only","no-req-sketch-deserialization"],"who_is_affected":"Applications that deserialize REQ sketches from untrusted input are exposed. Applications that only build sketches locally or load them from trusted sources can skip it. The sources do not describe further configuration.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000747,"input_tokens":4612,"output_tokens":571,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-123338':14A,17A '-2026':13A,16A '3.0.0':108C '5.3.0':110C '5.3.1':118C 'affect':103C 'apach':1A,19B,26B,70C,104C 'apache-datasketch':18B 'applic':42B,74C 'bound':66C 'c':3A,21B,28B,72C,106C 'code':61B 'compactor':33B,96C 'corrupt':7A,56B,88C 'craft':4A,46B,91C 'cve':12A,15A 'data':23B 'data-process':22B 'datasketch':2A,20B,27B,71C,105C 'deseri':37B,76C 'execut':62B 'fix':120C 'header':34B,97C 'heap':8A,54B,86C 'issu':102C,122C 'lead':59B 'load':11A,44B 'memori':9A,55B,87C 'out-of-bound':63C 'packag':25B 'process':24B 'recommend':113C 'req':5A,39B,78C 'serial':32B,95C 'sketch':6A,40B,47B,79C,92C 'sourc':51B,83C 'untrust':50B,82C 'upgrad':115C 'user':111C 'valid':31B,100C 'version':117C 'vulner':68C 'write':67C","nicknames":[],"mitigations":[],"who_affected":"Applications that deserialize REQ sketches from untrusted input are exposed. Applications that only build sketches locally or load them from trusted sources can skip it. The sources do not describe further configuration.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apachedatasketches","c","dataprocessing","high","package"],"campaign_type":null,"search_a":"'-123338':14A,17A '-2026':13A,16A 'apach':1A 'c':3A 'corrupt':7A 'craft':4A 'cve':12A,15A 'datasketch':2A 'heap':8A 'load':11A 'memori':9A 'req':5A 'sketch':6A","search_b":"'apach':19B,26B 'apache-datasketch':18B 'applic':42B 'c':21B,28B 'code':61B 'compactor':33B 'corrupt':56B 'craft':46B 'data':23B 'data-process':22B 'datasketch':20B,27B 'deseri':37B 'execut':62B 'header':34B 'heap':54B 'lead':59B 'load':44B 'memori':55B 'packag':25B 'process':24B 'req':39B 'serial':32B 'sketch':40B,47B 'sourc':51B 'untrust':50B 'valid':31B","search_c":"'3.0.0':108C '5.3.0':110C '5.3.1':118C 'affect':103C 'apach':70C,104C 'applic':74C 'bound':66C 'c':72C,106C 'compactor':96C 'corrupt':88C 'craft':91C 'datasketch':71C,105C 'deseri':76C 'fix':120C 'header':97C 'heap':86C 'issu':102C,122C 'memori':87C 'out-of-bound':63C 'recommend':113C 'req':78C 'serial':95C 'sketch':79C,92C 'sourc':83C 'untrust':82C 'upgrad':115C 'user':111C 'valid':100C 'version':117C 'vulner':68C 'write':67C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T11:17:16+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123338","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123338","severity":null,"published_at":"2026-11-13T11:17:16+00:00","modified_at":"2026-11-13T11:17:16+00:00","first_seen_at":"2026-11-13T11:44:16+00:00","fetched_at":"2026-11-13T11:44:16+00:00","note":null}],"documents":[{"id":145726,"url":"https://github.com/apache/datasketches-cpp/commit/9839ffd2ccc038d453e38b545750a5ed2d589dea","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":145725,"url":"https://github.com/apache/datasketches-cpp/releases/tag/5.3.1","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}