CVE-2026-103634Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in Count-Min sketch deserialization allows memory corruption via a crafted sketch
Updated under an hour ago ()
Does this affect you?
It affects Apache Software Foundation Apache DataSketches. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Out-of-bounds read and write in the Count-Min sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). count_min_sketch::deserialize() did not include the preamble in its input size check, so a truncated sketch could cause a read of up to 16 bytes past the end of the input. In addition, the table size was computed from the serialized number of buckets and number of hash functions in 32-bit arithmetic. A crafted sketch could make it wrap to zero, so that the sketch deserialized with an empty table, and later updates and estimate queries read and wrote outside the heap allocation. This can corrupt heap memory, causing a crash and potentially enabling further exploitation. This issue affects Apache DataSketches C++: from 4.1.0 before 5.3.0. Only applications that deserialize Count-Min sketches from untrusted sources are affected. Users are recommended to upgrade to version 5.3.0, which fixes this issue.
- CVSS
- Not yet scored
- Weakness (CWE)
- CWE-787, CWE-190
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- apache
- NVD analysis
- Received
- Record last updated
- Oct 22, 2026
- First seen by InfoSec Signals
- Oct 22, 2026
Affected products
Apache Software Foundation Apache DataSketches apache_software_foundation:apache_datasketches (from the name) | from 4.1.0 through 5.2.0 | CNA record |
References
- https://lists.apache.org/thread/rkx9oh06g5cjc6vmmpqloxwfz0gzz01hvendor-advisory
- https://github.com/apache/datasketches-cpp/releases/tag/5.3.0release-notes
- http://www.openwall.com/lists/oss-security/2026/10/10/4
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.