CVE-2026-87962: t-digest Library DOS Vulnerability

CVE-2026-87962 Overview

CVE-2026-87962 is a denial of service vulnerability in the t-digest library, an open-source Java implementation used for streaming quantile estimation. Versions 3.1 through 3.3 fail to validate length and capacity fields in serialized data processed by MergingDigest.fromBytes. Attackers can supply crafted serialized digests with mismatched header fields to trigger ArrayIndexOutOfBoundsException or NegativeArraySizeException, aborting the parsing thread. The flaw is tracked under CWE-1284: Improper Validation of Specified Quantity in Input.

Critical Impact
Remote, unauthenticated attackers can crash any service that deserializes untrusted t-digest byte payloads, disrupting availability of analytics, telemetry, and monitoring pipelines built on this library.

Affected Products

t-digest version 3.1
t-digest version 3.2
t-digest version 3.3

Discovery Timeline

2026-09-10 - CVE-2026-87962 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87962

Vulnerability Analysis

The t-digest library provides probabilistic data structures for approximating quantiles over streaming data. Applications frequently serialize and transmit digest state between nodes using the MergingDigest.fromBytes method. This method reads length and capacity metadata from the byte buffer and immediately uses those values to allocate arrays and index into the buffer.

Because the parser trusts the declared sizes without cross-checking them against the actual buffer length or against sane bounds, a malformed header can force out-of-range array access. The parsing thread then throws an unchecked exception, terminating the operation and, in single-threaded ingest paths, aborting the containing request or pipeline.

Root Cause

The root cause is missing input validation in MergingDigest.fromBytes. The deserializer accepts attacker-controlled integers describing centroid count and buffer capacity, then uses those integers directly for array sizing and offset arithmetic. Negative or oversized values produce NegativeArraySizeException or ArrayIndexOutOfBoundsException before any semantic checks run. Additional technical context is available in GitHub Issue #227 and the VulnCheck T-Digest DoS Advisory.

Attack Vector

Exploitation requires no authentication and no user interaction. Any network-reachable endpoint that deserializes t-digest payloads from untrusted sources is exposed. Typical exposure points include distributed analytics services, metric aggregation backends, and inter-node communication in search or observability platforms that embed t-digest as a transitive dependency. An attacker submits a crafted byte array with header fields that misrepresent the actual payload size, and the receiving process throws an uncaught exception. Refer to the MergingDigest source for the vulnerable code path.

Detection Methods for CVE-2026-87962

Indicators of Compromise

Repeated java.lang.ArrayIndexOutOfBoundsException or java.lang.NegativeArraySizeException stack traces originating in com.tdunning.math.stats.MergingDigest.fromBytes.
Unexpected termination of ingest, aggregation, or search worker threads immediately after processing external byte payloads.
Application logs showing malformed digest payloads received from untrusted or internet-facing endpoints.

Detection Strategies

Perform software composition analysis (SCA) across Java projects to identify direct and transitive dependencies on com.tdunning:t-digest versions 3.1 through 3.3.
Instrument deserialization entry points with structured exception logging so parser crashes surface distinctly from application errors.
Correlate spikes in worker-thread restarts with inbound requests to endpoints that accept binary digest data.

Monitoring Recommendations

Alert on elevated rates of ArrayIndexOutOfBoundsException and NegativeArraySizeException from services known to consume t-digest payloads.
Track anomalous request patterns to APIs that accept serialized statistical state, especially undersized payloads with oversized declared lengths.
Monitor process uptime and thread pool health for backend services performing streaming quantile computations.

How to Mitigate CVE-2026-87962

Immediate Actions Required

Inventory all applications using t-digest 3.1, 3.2, or 3.3, including transitive dependencies pulled in by analytics or search frameworks.
Restrict network exposure of endpoints that deserialize digest payloads to trusted callers only, using authentication and network segmentation.
Wrap calls to MergingDigest.fromBytes in defensive try/catch blocks that reject malformed input without terminating shared worker threads.

Patch Information

At the time of publication, consult the t-digest GitHub repository and the VulnCheck advisory for the latest fixed version and upgrade guidance. Upgrade to the first release that includes length and capacity validation in MergingDigest.fromBytes.

Workarounds

Validate declared length and capacity fields against the actual buffer size before invoking MergingDigest.fromBytes.
Reject digest payloads exceeding a conservative maximum size defined by your application.
Isolate deserialization in a dedicated thread pool so parser exceptions do not disrupt the primary request-handling threads.

bash

# Identify vulnerable t-digest versions in a Maven project
mvn dependency:tree -Dincludes=com.tdunning:t-digest

# Identify vulnerable t-digest versions in a Gradle project
./gradlew dependencies --configuration runtimeClasspath | grep t-digest