CVE-2026-14686: HdrHistogram Privilege Escalation Flaw

CVE-2026-14686 Overview

CVE-2026-14686 is an incorrect comparison vulnerability [CWE-697] in HdrHistogram versions up to 2.2.2. The flaw resides in the org.HdrHistogram.DoubleHistogram.recordValue function within src/main/java/org/HdrHistogram/DoubleHistogram.java, specifically in the Range Check component. Manipulating input to this function results in an incorrect comparison that can affect data integrity in histogram calculations. The attack requires local access and low privileges. A proof of concept has been made public. The maintainers were notified through an issue report but have not responded at the time of publication.

Critical Impact
A local attacker with low privileges can trigger incorrect range comparisons in DoubleHistogram.recordValue, resulting in limited integrity impact on histogram data used by applications that depend on HdrHistogram.

Affected Products

HdrHistogram versions up to and including 2.2.2
Java applications embedding org.HdrHistogram.DoubleHistogram
Downstream libraries and telemetry stacks that ship HdrHistogram as a dependency

Discovery Timeline

2026-07-05 - CVE-2026-14686 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-14686

Vulnerability Analysis

HdrHistogram is a Java library for recording latency and value distributions with configurable precision. The DoubleHistogram class extends this functionality to floating-point values. The recordValue method performs a Range Check before storing the sample in the internal histogram buckets.

The vulnerability stems from an incorrect comparison operation in this Range Check. When a caller supplies a boundary value, the comparison does not enforce the intended bounds. The library either accepts values it should reject or rejects values it should accept. This affects the integrity of aggregated histogram data used for latency measurement, capacity planning, and service level objective tracking.

Exploitation is limited to local contexts where an attacker can influence the values passed to recordValue. The scope does not extend beyond the histogram data itself, and confidentiality and availability are not affected.

Root Cause

The root cause is an incorrect comparison [CWE-697] inside the Range Check logic of DoubleHistogram.recordValue in src/main/java/org/HdrHistogram/DoubleHistogram.java. The comparison operator or boundary constant used to validate whether a value falls within the configured tracked range does not match the specification. As a result, edge-case values near the histogram bounds are handled inconsistently.

Attack Vector

An attacker requires local access with low privileges to supply crafted floating-point values to an application that records those values through DoubleHistogram.recordValue. The manipulation causes the range check to reach an incorrect decision, corrupting the recorded distribution. There is no network attack path and no user interaction is required. The exploit code is public per the CVE description, though no verified proof-of-concept URL is included in the reference set.

The vulnerability is described in the HdrHistogram GitHub Issue #222 and tracked in VulDB CVE-2026-14686. See the security advisory and issue tracker for technical details of the incorrect comparison.

Detection Methods for CVE-2026-14686

Indicators of Compromise

Anomalous histogram outputs from services using HdrHistogram, such as latency percentiles that fall outside configured highestTrackableValue or lowestDiscernibleValue bounds
Application logs showing values passed to recordValue at or beyond documented range limits without corresponding exceptions
Unexpected shifts in reported service level indicators or capacity metrics that cannot be correlated with real workload changes

Detection Strategies

Perform a software composition analysis (SCA) scan across build manifests (pom.xml, build.gradle) to identify projects that declare org.hdrhistogram:HdrHistogram at version 2.2.2 or earlier
Instrument applications to log or assert on inputs supplied to DoubleHistogram.recordValue and flag values near the configured range boundaries
Compare percentile outputs from HdrHistogram against an independent measurement pipeline to identify drift caused by the incorrect comparison

Monitoring Recommendations

Track dependency versions in production images and alert when HdrHistogram versions at or below 2.2.2 are deployed
Monitor telemetry pipelines that consume histogram output for statistical outliers and integrity discrepancies
Audit local process activity that writes measurement inputs to applications embedding HdrHistogram, since the attack requires local access

How to Mitigate CVE-2026-14686

Immediate Actions Required

Inventory all Java services and libraries that depend on HdrHistogram version 2.2.2 or earlier
Restrict local access to hosts running applications that rely on HdrHistogram for security-relevant measurements
Validate and clamp values supplied to DoubleHistogram.recordValue at the application layer before invoking the library

Patch Information

At the time of publication no vendor patch is available. The maintainers were informed through GitHub Issue #222 but have not responded. Monitor the HdrHistogram GitHub repository for a fixed release beyond version 2.2.2 and consult VulDB Vulnerability #376282 for updated remediation guidance.

Workarounds

Wrap calls to DoubleHistogram.recordValue with explicit range validation that enforces the histogram's lowestDiscernibleValue and highestTrackableValue before recording
Pin dependency versions in build tooling and rebuild artifacts once an upstream fix is released
Where feasible, migrate integrity-sensitive measurements to Histogram (integer-based) usage patterns until a corrected DoubleHistogram is available

bash

# Configuration example: enforce a defensive range check before recording
# Pseudocode for a wrapper around DoubleHistogram.recordValue
# if (value >= LOWEST_DISCERNIBLE && value <= HIGHEST_TRACKABLE) {
#     histogram.recordValue(value);
# } else {
#     logger.warn("Rejected out-of-range sample: {}", value);
# }