Skip to content
Fencer Intel
low —

CVE-2026-122096 json

Apache DataSketches Java: Uncontrolled resource consumption when deserializing crafted sketch images

published 22h ago modified 21h ago also EUVD-2026-123401

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no EPSS score yet
public exploits
0
none known

Summary

Uncontrolled Resource Consumption vulnerability in the sketch deserialization of Apache DataSketches Java.

Several deserializers trusted sizes and counts declared in the serialized input. A small crafted input could make an application allocate an excessive amount of memory, leading to an OutOfMemoryError. A crafted string passed to FrequentLongsSketch.getInstance(String) could also make deserialization, or a later update, loop indefinitely. Only applications that deserialize sketches from untrusted sources are affected.

This issue affects Apache DataSketches Java: through 9.0.0.

Users are recommended to upgrade to version 9.1.0, which fixes the issue.

Patch / fix

Is CVE-2026-122096 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
maven org.apache.datasketches:datasketches-java
<=9.0.0
 no fix listed

Affected products

  • Apache Software Foundation Apache DataSketches Java

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption
  • CWE-789 Memory Allocation with Excessive Size Value
  • CWE-835 Loop with Unreachable Exit Condition

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.