Out-of-Bounds Write Vulnerability in Apache DataSketches C++
CVE-2026-123274

Currently unrated

Key Information:

Vendor: Apache
Status: Apache Datasketches C++
Vendor: CVE Published:; 13 November 2026

What is CVE-2026-123274?

The vulnerability in Apache DataSketches C++ arises from improper validation of serialized level boundaries when deserializing KLL sketches from untrusted sources. This oversight can lead to heap memory corruption, potentially allowing an attacker to manipulate application behavior or cause instability. Users are advised to transition to version 5.3.1 or higher, where this issue has been addressed.

Affected Version(s)

Apache DataSketches C++ 1.0.0-incubating <= 5.3.0

References

https://lists.apache.org/thread/t4rngyg9cbv1b42f1d0crgpgt...

vendor-advisory

https://github.com/apache/datasketches-cpp/releases/tag/5...

release-notes

https://github.com/apache/datasketches-cpp/commit/bb86d43...

patch

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Nov 13, 2026
Vulnerability Reserved
Nov 5, 2026

Credit

hataehoon

CVE-2026-123274 Data

JSON