GCVE - cpe:2.3:a:tdunning:t-digest:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:tdunning:t-digest:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Tdunning (`560a1ddd-6b2c-5f1d-a2dc-7523183ca5ac`)
Product	T Digest (`69c5844f-a006-524d-b25a-9c58ccafbf5b`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-87962`	vulnerable	2026-09-16 04:33:01.178807	t-digest 3.1 through 3.3 Denial of Service via Unvalidated Length Fields in MergingDigest.fromBytes HIGH (7.5) t-digest versions 3.1 through 3.3 contain a denial of service vulnerability in MergingDigest.fromBytes that fails to validate length and capacity fields from serialized data. Attackers can supply crafted serialized digests with mismatched header fields to trigger ArrayIndexOutOfBoundsException or NegativeArraySizeException, aborting the parsing thread. Published: 2026-09-10T10:52:38.047Z Updated: 2026-09-10T12:56:58.192Z Open on db.gcve.eu Reference links https://github.com/tdunning/t-digest/issues/227 https://github.com/tdunning/t-digest/blob/7905f3d2ad18e7d7176811147d1316a3e23d7061/core/src/main/java/com/tdunning/math/stats/MergingDigest.java https://github.com/tdunning/t-digest https://www.vulncheck.com/advisories/t-digest-3.1-through-3.3-denial-of-service-via-unvalidated-length-fields-in-mergingdigest-frombytes	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-87822`	vulnerable	2026-09-16 04:33:01.088744	t-digest 3.1 through 3.3 Denial of Service via NaN Centroid Means in MergingDigest.fromBytes HIGH (7.5) t-digest versions 3.1 through 3.3 fail to validate centroid means during deserialization in MergingDigest.fromBytes, allowing attackers to inject NaN values that bypass validation checks. Attackers can craft malicious serialized digests containing NaN centroids that degrade sorting performance from O(n log n) to O(n squared), causing severe processing delays during merge operations. Published: 2026-09-09T14:32:42.726Z Updated: 2026-09-10T14:57:02.770Z Open on db.gcve.eu Reference links https://github.com/tdunning/t-digest/issues/229 https://github.com/tdunning/t-digest/blob/8d5c1523c3d46925e9b3979a8d63c0b9d004ed1c/core/src/main/java/com/tdunning/math/stats/MergingDigest.java https://github.com/tdunning/t-digest/blob/8d5c1523c3d46925e9b3979a8d63c0b9d004ed1c/core/src/main/java/com/tdunning/math/stats/Sort.java https://github.com/tdunning/t-digest https://www.vulncheck.com/advisories/t-digest-3.1-through-3.3-denial-of-service-via-nan-centroid-means-in-mergingdigest-frombytes	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

T Digest

Notes

PURL mappings

Vulnerability references

Contribute