CVE-2026-87822: t-digest Library DOS Vulnerability

CVE-2026-87822 Overview

CVE-2026-87822 is a denial of service vulnerability in the t-digest Java library, versions 3.1 through 3.3. The flaw resides in MergingDigest.fromBytes, which fails to validate centroid means during deserialization. Attackers can craft malicious serialized digests containing NaN (Not a Number) centroid values that bypass existing validation checks. When the library processes these digests, sorting performance collapses from O(n log n) to O(n²), causing severe processing delays during merge operations. The vulnerability is categorized under CWE-407: Inefficient Algorithmic Complexity and is exploitable over the network without authentication or user interaction.

Critical Impact
Remote attackers can trigger algorithmic complexity attacks that exhaust CPU resources on any service deserializing untrusted t-digest byte streams.

Affected Products

t-digest version 3.1
t-digest version 3.2
t-digest version 3.3

Discovery Timeline

2026-09-09 - CVE-2026-87822 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87822

Vulnerability Analysis

The t-digest library implements a probabilistic data structure for computing rank-based statistics such as quantiles and percentiles over streaming data. The MergingDigest variant reconstructs its internal state from a serialized byte array through the fromBytes static method. During this deserialization step, the library reads centroid mean values without verifying that they are finite numbers.

An attacker who can supply a serialized digest to a vulnerable consumer can inject NaN values into the centroid array. Because NaN fails standard IEEE 754 comparison semantics, downstream sort operations produce inconsistent ordering decisions. This defeats the pivot selection heuristics used by the library's quicksort implementation in Sort.java and forces worst-case quadratic behavior during subsequent merge operations.

The result is a computational denial of service: a single crafted payload can consume disproportionate CPU time on the target host, blocking threads and degrading service availability for legitimate requests.

Root Cause

The root cause is missing input validation in MergingDigest.fromBytes. The deserializer accepts any double value for a centroid mean, including NaN and infinity, without rejecting or normalizing them. Sorting routines in Sort.java rely on transitive, total ordering of centroid means, an assumption NaN violates. See GitHub Issue #229 and the VulnCheck t-digest DoS Advisory for additional analysis.

Attack Vector

Exploitation requires the attacker to deliver a crafted serialized MergingDigest byte stream to an application that deserializes it. Typical vectors include analytics APIs, telemetry ingestion pipelines, monitoring backends, and database extensions that accept t-digest payloads from external clients. No authentication, privileges, or user interaction are required when the deserialization endpoint is exposed to the network.

A proof-of-concept payload constructs a MergingDigest, replaces one or more centroid mean values with Double.NaN prior to serialization, and submits the resulting bytes to the target. See the t-digest source repository and the affected files MergingDigest.java and Sort.java for the vulnerable code paths.

Detection Methods for CVE-2026-87822

Indicators of Compromise

Sustained CPU saturation on JVM processes that deserialize t-digest payloads, coinciding with inbound requests carrying serialized digest data.
Thread dumps showing extended time spent inside com.tdunning.math.stats.Sort or MergingDigest.merge frames.
Request latency spikes on analytics or aggregation endpoints without corresponding increases in payload count or size.

Detection Strategies

Instrument deserialization paths to validate that all centroid means satisfy Double.isFinite(x) before accepting the payload.
Add application-layer logging that records payload sources when digest processing exceeds a defined execution-time threshold.
Perform dependency scanning on Java projects to identify use of com.tdunning:t-digest versions 3.1, 3.2, or 3.3.

Monitoring Recommendations

Alert on JVM CPU utilization anomalies on services that ingest external statistical data.
Track per-request processing time distributions on APIs handling t-digest input and flag long-tail outliers for review.
Correlate upstream client identities with services exhibiting degraded response times to isolate abusive senders.

How to Mitigate CVE-2026-87822

Immediate Actions Required

Inventory all Java applications and dependencies to identify use of t-digest versions 3.1 through 3.3, including transitive dependencies.
Restrict network access to services that deserialize t-digest payloads so that only trusted producers can submit data.
Add input validation in front of MergingDigest.fromBytes to reject payloads whose byte representation could decode to non-finite doubles.

Patch Information

At the time of publication, no fixed release has been listed in the NVD entry. Consult the t-digest GitHub repository and GitHub Issue #229 for the latest patch status and refer to the VulnCheck advisory for remediation guidance.

Workarounds

Wrap calls to MergingDigest.fromBytes with a validation routine that iterates centroid means and rejects any value where Double.isNaN or Double.isInfinite returns true.
Enforce request-level CPU or execution-time budgets on threads handling digest deserialization, terminating operations that exceed the budget.
Require signed or authenticated digest payloads from trusted internal producers only, disabling ingestion from anonymous or external clients.

bash

# Configuration example: identify vulnerable t-digest usage with Maven
mvn dependency:tree -Dincludes=com.tdunning:t-digest