Denial of Service in t-digest Affected by NaN Centroid Means
CVE-2026-87822

8.7HIGH

Key Information:

Vendor

Tdunning

Status
T-digest
Vendor
CVE Published:
9 September 2026

What is CVE-2026-87822?

Versions 3.1 through 3.3 of t-digest contain a vulnerability related to the deserialization process in MergingDigest.fromBytes. The failure to validate centroid means allows attackers to inject NaN values into serialized digests. This manipulation can degrade the performance of sorting operations from O(n log n) to O(n squared), leading to significant processing delays during merge operations. This vulnerability poses a risk of denial of service, as it can severely hinder the functioning of applications utilizing the affected product.

Affected Version(s)

t-digest 3.1 <= 3.3

References

https://github.com/tdunning/t-digest/issues/229
issue-tracking
https://github.com/tdunning/t-digest/blob/8d5c1523c3d4692...
technical-description
https://github.com/tdunning/t-digest/blob/8d5c1523c3d4692...
technical-description

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yu Bao, PayPal Cyber Security Team
.