Uncontrolled Resource Consumption in Apache DataSketches Java

CVE-2026-122096

What is CVE-2026-122096?

A vulnerability exists in the deserialization mechanism of Apache DataSketches Java, where trusted sizes and counts from serialized input can lead to unsafe resource allocation. This flaw may cause applications to allocate excessive memory, potentially resulting in an OutOfMemoryError. Additionally, a specially crafted input passed to the FrequentLongsSketch.getInstance(String) method could trigger infinite loops during deserialization or subsequent updates. Only applications accepting sketches from untrusted sources are vulnerable, thus emphasizing the need for strict input validation. Users are encouraged to upgrade to version 9.1.0 to mitigate this issue.

References