CVE-2026-14685 Overview
CVE-2026-14685 affects HdrHistogram versions up to 2.2.2, a Java library used for high dynamic range histogram value recording. The vulnerability resides in the recordValueWithCount function within src/main/java/org/HdrHistogram/AbstractHistogram.java. Manipulation of the Count argument produces a state issue in the AbstractHistogram component [CWE-371]. The flaw requires local access with low privileges and produces limited integrity impact without affecting confidentiality or availability. The exploit has been publicly disclosed. The maintainers received an issue report but have not responded at the time of publication.
Critical Impact
Local attackers with low privileges can manipulate histogram state through crafted Count argument values, potentially corrupting recorded metrics used for performance measurement and monitoring decisions.
Affected Products
- HdrHistogram library versions up to and including 2.2.2
- Java applications embedding the AbstractHistogram component
- Downstream projects consuming the recordValueWithCount API
Discovery Timeline
- 2026-07-05 - CVE-2026-14685 published to NVD
- 2026-07-06 - Last updated in NVD database
Technical Details for CVE-2026-14685
Vulnerability Analysis
HdrHistogram is a Java library for recording values across a configurable dynamic range with configurable precision. The recordValueWithCount method in AbstractHistogram.java records a value together with a caller-supplied count parameter. The vulnerability arises because the function does not properly validate or handle certain values passed via the Count argument, resulting in an incomplete or inconsistent internal state [CWE-371].
The flaw is classified as a state issue rather than a memory safety problem. Consumers of the histogram receive inaccurate percentile, min, max, or total-count values when the internal state is corrupted. Applications that rely on HdrHistogram for latency measurement, SLA reporting, or auto-scaling decisions may act on invalid data.
The attack requires local access and low privileges. The exploit has been disclosed publicly through VulDB. See the VulDB entry for CVE-2026-14685 and the upstream GitHub Issue #221 Discussion for further technical detail.
Root Cause
The root cause is incomplete handling of state within recordValueWithCount. The method updates several internal counters and bucket structures when recording a value with a supplied multiplicity. When the Count argument takes on an unexpected value, the sequence of state updates does not complete atomically or consistently, leaving the histogram in a state that misrepresents recorded data.
Attack Vector
Exploitation requires an attacker who can invoke recordValueWithCount directly or through an application path that forwards attacker-controlled input to the Count parameter. The attack is limited to the local environment and does not traverse network boundaries. Impact is confined to integrity of histogram state; no code execution or information disclosure has been demonstrated.
No verified proof-of-concept code is published in vetted repositories. Refer to the GitHub HdrHistogram Repository and linked issue for source-level review.
Detection Methods for CVE-2026-14685
Indicators of Compromise
- Unexplained anomalies in histogram output such as impossible percentiles, negative totals, or counts exceeding recorded sample volume
- Application logs showing calls to recordValueWithCount with attacker-influenced Count values
- Divergence between HdrHistogram-reported metrics and independent measurement sources
Detection Strategies
- Perform dependency scanning on Java projects to identify HdrHistogram versions at or below 2.2.2
- Review application code for paths that expose the Count parameter of recordValueWithCount to untrusted or user-influenced input
- Add unit tests that validate histogram invariants (total count equals sum of bucket counts) after recording operations
Monitoring Recommendations
- Monitor build pipelines and software composition analysis reports for the presence of vulnerable org.HdrHistogram artifacts
- Alert on runtime exceptions or assertion failures originating from AbstractHistogram class methods
- Correlate metrics anomalies with recent changes to code paths that invoke histogram recording APIs
How to Mitigate CVE-2026-14685
Immediate Actions Required
- Inventory all Java applications and services that include HdrHistogram 2.2.2 or earlier as a direct or transitive dependency
- Restrict local access to systems running affected applications until a fix is available
- Audit application code to ensure the Count argument passed to recordValueWithCount is validated against expected ranges before invocation
Patch Information
At the time of publication, the HdrHistogram project has been notified through an issue report but has not released a patch. Monitor the GitHub HdrHistogram Repository and GitHub Issue #221 Discussion for upstream fix availability. Apply the fixed release once published and rebuild all downstream artifacts.
Workarounds
- Wrap calls to recordValueWithCount with input validation that rejects zero, negative, or unexpectedly large Count values
- Prefer recordValue(long value) over recordValueWithCount(long value, long count) where the count multiplicity is not required
- Isolate histogram-consuming services so that only trusted internal components can invoke recording APIs
# Example dependency check using Maven to identify vulnerable HdrHistogram versions
mvn dependency:tree -Dincludes=org.hdrhistogram:HdrHistogram
# Example Gradle equivalent
gradle dependencyInsight --dependency HdrHistogram
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
