Please do not report security vulnerabilities through public GitHub issues, pull requests or mailing lists.
Report them privately to the Apache Security Team at [email protected], or to the Apache DataSketches PMC at [email protected]. Apache DataSketches follows the Apache vulnerability handling process.
Please include the affected component and version, a description of the issue and, if possible, a way to reproduce it (for example, a serialized sketch that triggers it).
The Apache DataSketches PMC supports only the latest release of each component. Security fixes are made in the next release and are not backported. Users should upgrade to the latest release to receive fixes.
All of the following affect only applications that deserialize sketches from untrusted sources. CVE-2026-123274 and CVE-2026-123338 are fixed in DataSketches C++ 5.3.1. The others are fixed in DataSketches C++ 5.3.0.
| CVE | Severity | Description | Affected versions |
|---|---|---|---|
| CVE-2026-123274 | moderate | Out-of-bounds write in KLL sketch deserialization | 1.0.0-incubating through 5.3.0 |
| CVE-2026-123338 | moderate | Out-of-bounds write in REQ sketch deserialization | 3.0.0 through 5.3.0 |
| CVE-2026-103501 | moderate | Heap buffer overflow in HLL sketch deserialization | 1.0.0-incubating through 5.2.0 |
| CVE-2026-103513 | moderate | Out-of-bounds read and write in CPC sketch deserialization | 2.0.0-incubating through 5.2.0 |
| CVE-2026-103634 | moderate | Out-of-bounds read and write in Count-Min sketch deserialization | 4.1.0 through 5.2.0 |
| CVE-2026-103635 | low | Out-of-bounds read in compact Theta sketch deserialization | 3.1.0 through 5.2.0 |
| CVE-2026-103636 | low | Out-of-bounds read in VarOpt union deserialization | 2.0.0-incubating through 5.2.0 |
Credit: hataehoon (reporter) for CVE-2026-123274.
This affects only applications that deserialize sketches from untrusted sources. It is fixed in DataSketches Java 9.1.0.
| CVE | Severity | Description | Affected versions |
|---|---|---|---|
| CVE-2026-122096 | low | Uncontrolled resource consumption when deserializing crafted sketch images | through 9.0.0 |
Credit: Jaideep Pyne (finder) for CVE-2026-122096.
