What’s Vulnerable › Vulnerabilities

CVE-2026-87822: t-digest 3.1 through 3.3 Denial of Service via NaN Centroid Means in MergingDigest.fromBytes

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-09 · updated 2026-09-10
• Weakness: CWE-407

Description

t-digest versions 3.1 through 3.3 fail to validate centroid means during deserialization in MergingDigest.fromBytes, allowing attackers to inject NaN values that bypass validation checks. Attackers can craft malicious serialized digests containing NaN centroids that degrade sorting performance from O(n log n) to O(n squared), causing severe processing delays during merge operations.

Affected products

• tdunning t-digest: from 3.1 through 3.3

References

• https://github.com/tdunning/t-digest
• https://github.com/tdunning/t-digest/blob/8d5c1523c3d46925e9b3979a8d63c0b9d004ed1c/core/src/main/java/com/tdunning/math/stats/MergingDigest.java
• https://github.com/tdunning/t-digest/blob/8d5c1523c3d46925e9b3979a8d63c0b9d004ed1c/core/src/main/java/com/tdunning/math/stats/Sort.java
• https://github.com/tdunning/t-digest/issues/229
• https://www.vulncheck.com/advisories/t-digest-3.1-through-3.3-denial-of-service-via-nan-centroid-means-in-mergingdigest-frombytes

Get alerted when CVE-2026-87822 or the next vulnerability affects your stack