Out-of-Bounds Write Vulnerability in Apache DataSketches C++ Software
CVE-2026-123338

Currently unrated

Key Information:

Vendor: Apache
Status: Apache Datasketches C++
Vendor: CVE Published:; 13 November 2026

What is CVE-2026-123338?

An out-of-bounds write vulnerability exists in Apache DataSketches C++ due to improper validation of serialized compactor headers. This flaw can be exploited when an application deserializes a REQ sketch from an untrusted source, leading to potential heap memory corruption. To mitigate risks, users should upgrade to version 5.3.1, which addresses this issue.

Affected Version(s)

Apache DataSketches C++ 3.0.0 <= 5.3.0

References

https://lists.apache.org/thread/wjsso4wl0f0nczwh7gd74kc5w...

vendor-advisory

https://github.com/apache/datasketches-cpp/releases/tag/5...

release-notes

https://github.com/apache/datasketches-cpp/commit/9839ffd...

patch

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Nov 13, 2026
Vulnerability Reserved
Nov 5, 2026

CVE-2026-123338 Data

JSON