CVE-2026-14684: HdrHistogram DOS Vulnerability

CVE-2026-14684 Overview

CVE-2026-14684 is an uncontrolled resource consumption vulnerability [CWE-400] in HdrHistogram versions up to 2.2.2. The flaw resides in the org.HdrHistogram.AbstractHistogram.decodeFromByteBuffer function within src/main/java/org/HdrHistogram/AbstractHistogram.java. Manipulating the numberOfSignificantValueDigits argument triggers uncontrolled memory allocation. The attack requires local access and low privileges. A public exploit exists, and the project maintainers have not yet responded to the disclosure.

Critical Impact
A local attacker with low privileges can trigger uncontrolled memory allocation in HdrHistogram by manipulating the numberOfSignificantValueDigits parameter, causing denial of service in applications that decode untrusted histogram byte buffers.

Affected Products

HdrHistogram versions up to and including 2.2.2
Java applications embedding HdrHistogram for latency and performance histogram encoding
Downstream libraries that expose decodeFromByteBuffer to untrusted input

Discovery Timeline

2026-07-05 - CVE-2026-14684 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-14684

Vulnerability Analysis

HdrHistogram is a Java library for recording and analyzing latency and value distributions with configurable precision. The decodeFromByteBuffer method reconstructs a histogram from a serialized ByteBuffer. During decoding, the routine reads the numberOfSignificantValueDigits value from the incoming buffer and uses it to size internal counting arrays.

When an attacker supplies a crafted byte buffer with a large or unexpected value for numberOfSignificantValueDigits, the library allocates memory proportional to that value without validating an upper bound. The resulting allocation can exhaust JVM heap capacity and terminate the host application.

The attack vector is local, meaning the adversary must already have some level of access to a process that decodes histogram data. Impact is limited to availability, with no direct confidentiality or integrity consequences.

Root Cause

The root cause is missing validation of the numberOfSignificantValueDigits field read from serialized input. The decoding path trusts attacker-controlled sizing metadata and passes it into array allocation without enforcing the documented valid range of 0 to 5.

Attack Vector

Exploitation requires the target application to call decodeFromByteBuffer on untrusted data provided by a local low-privileged actor. The attacker constructs a serialized histogram with an oversized precision value, submits it through the application's normal ingestion path, and the JVM attempts a large heap allocation that leads to an OutOfMemoryError or process termination.

The vulnerability manifests during deserialization. See the GitHub Issue Discussion for maintainer-facing details on the flaw.

Detection Methods for CVE-2026-14684

Indicators of Compromise

Repeated java.lang.OutOfMemoryError events in application logs originating from org.HdrHistogram.AbstractHistogram.decodeFromByteBuffer stack frames
Sudden JVM heap spikes correlated with ingestion of serialized histogram payloads
Unexpected process restarts or crashes in services that consume HdrHistogram binary data from local sources

Detection Strategies

Inventory Java applications and their transitive dependencies to identify HdrHistogram versions at or below 2.2.2 using software composition analysis tools
Instrument the JVM with heap allocation monitoring and flag calls to decodeFromByteBuffer that request abnormally large arrays
Review code paths that expose decodeFromByteBuffer to file, socket, or IPC input and confirm that upstream validation is present

Monitoring Recommendations

Alert on OOM crashes and abnormal garbage collection pauses in services that decode histogram data
Track HdrHistogram library versions across build pipelines and container images
Capture and retain crash dumps to correlate faulting frames with AbstractHistogram.decodeFromByteBuffer

How to Mitigate CVE-2026-14684

Immediate Actions Required

Restrict decodeFromByteBuffer inputs to trusted sources only until a fixed release is available
Validate the numberOfSignificantValueDigits value in the serialized buffer before invoking the decoder and reject values outside the documented range of 0 to 5
Apply JVM heap limits and container memory constraints so a single OOM condition does not cascade across services

Patch Information

As of the last NVD update on 2026-07-06, the HdrHistogram maintainers have not published a fixed release. Track the GitHub Project Repository and the GitHub Issue Discussion for patch availability. Consult the VulDB CVE-2026-14684 entry for updates.

Workarounds

Wrap calls to decodeFromByteBuffer in a validation layer that inspects the precision field and rejects malformed buffers before allocation
Isolate histogram decoding into a sandboxed process with strict memory limits so failures do not affect the primary application
Remove or gate features that accept HdrHistogram binary payloads from local low-privileged users until a fix ships

bash

# Configuration example: enforce JVM heap ceiling and OOM containment
java -Xmx512m \
     -XX:+ExitOnOutOfMemoryError \
     -XX:+HeapDumpOnOutOfMemoryError \
     -XX:HeapDumpPath=/var/log/jvm/heapdump.hprof \
     -jar your-application.jar