Denial of Service Vulnerability in t-digest by T.Dunning
CVE-2026-87962

8.7HIGH

Key Information:

Vendor

Tdunning

Status
T-digest
Vendor
CVE Published:
10 September 2026

What is CVE-2026-87962?

The t-digest library versions 3.1 through 3.3 are susceptible to a denial of service issue within the MergingDigest.fromBytes method. This vulnerability arises due to insufficient validation of length and capacity fields from serialized data. Malicious actors can exploit this flaw by providing specially crafted serialized digests that contain mismatched header fields. Such an attack can lead to critical exceptions like ArrayIndexOutOfBoundsException or NegativeArraySizeException, ultimately causing the parsing thread to abort and create significant service disruptions.

Affected Version(s)

t-digest 3.1 <= 3.3

References

https://github.com/tdunning/t-digest/issues/227
issue-tracking
https://github.com/tdunning/t-digest/blob/7905f3d2ad18e7d...
technical-description
https://github.com/tdunning/t-digest
product

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yu Bao, PayPal Cyber Security Team
.