Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
2 vulnerabilities by tdunning
CVE-2026-87822 (GCVE-0-2026-87822)
Vulnerability from nvd – Published: 2026-09-09 14:32 – Updated: 2026-09-09 14:32
VLAI
EPSS
VEX
Title
t-digest 3.1 through 3.3 Denial of Service via NaN Centroid Means in MergingDigest.fromBytes
Summary
t-digest versions 3.1 through 3.3 fail to validate centroid means during deserialization in MergingDigest.fromBytes, allowing attackers to inject NaN values that bypass validation checks. Attackers can craft malicious serialized digests containing NaN centroids that degrade sorting performance from O(n log n) to O(n squared), causing severe processing delays during merge operations.
Severity
CWE
- CWE-407 - Inefficient Algorithmic Complexity
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/tdunning/t-digest/issues/229 | issue-tracking |
| https://github.com/tdunning/t-digest/blob/8d5c152… | technical-description |
| https://github.com/tdunning/t-digest/blob/8d5c152… | technical-description |
| https://github.com/tdunning/t-digest | product |
| https://www.vulncheck.com/advisories/t-digest-3.1… | third-party-advisory |
Date Public
2026-08-24 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo1.maven.org/maven2/com/tdunning/t-digest/",
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/com.tdunning/t-digest",
"product": "t-digest",
"repo": "https://github.com/tdunning/t-digest",
"vendor": "tdunning",
"versions": [
{
"lessThanOrEqual": "3.3",
"status": "affected",
"version": "3.1",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yu Bao, PayPal Cyber Security Team"
}
],
"datePublic": "2026-08-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "t-digest versions 3.1 through 3.3 fail to validate centroid means during deserialization in MergingDigest.fromBytes, allowing attackers to inject NaN values that bypass validation checks. Attackers can craft malicious serialized digests containing NaN centroids that degrade sorting performance from O(n log n) to O(n squared), causing severe processing delays during merge operations."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-407",
"description": "Inefficient Algorithmic Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T14:32:42.726Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "tdunning/t-digest issue #229",
"tags": [
"issue-tracking"
],
"url": "https://github.com/tdunning/t-digest/issues/229"
},
{
"name": "fromBytes writing centroid means with no NaN check at the 3.3 release commit",
"tags": [
"technical-description"
],
"url": "https://github.com/tdunning/t-digest/blob/8d5c1523c3d46925e9b3979a8d63c0b9d004ed1c/core/src/main/java/com/tdunning/math/stats/MergingDigest.java"
},
{
"name": "stableQuickSort three-way partition that degrades on NaN at the 3.3 release commit",
"tags": [
"technical-description"
],
"url": "https://github.com/tdunning/t-digest/blob/8d5c1523c3d46925e9b3979a8d63c0b9d004ed1c/core/src/main/java/com/tdunning/math/stats/Sort.java"
},
{
"tags": [
"product"
],
"url": "https://github.com/tdunning/t-digest"
},
{
"name": "VulnCheck Advisory: t-digest 3.1 through 3.3 Denial of Service via NaN Centroid Means in MergingDigest.fromBytes",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/t-digest-3.1-through-3.3-denial-of-service-via-nan-centroid-means-in-mergingdigest-frombytes"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "t-digest 3.1 through 3.3 Denial of Service via NaN Centroid Means in MergingDigest.fromBytes",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-87822",
"datePublished": "2026-09-09T14:32:42.726Z",
"dateReserved": "2026-09-09T10:32:34.110Z",
"dateUpdated": "2026-09-09T14:32:42.726Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87822 (GCVE-0-2026-87822)
Vulnerability from cvelistv5 – Published: 2026-09-09 14:32 – Updated: 2026-09-09 14:32
VLAI
EPSS
VEX
Title
t-digest 3.1 through 3.3 Denial of Service via NaN Centroid Means in MergingDigest.fromBytes
Summary
t-digest versions 3.1 through 3.3 fail to validate centroid means during deserialization in MergingDigest.fromBytes, allowing attackers to inject NaN values that bypass validation checks. Attackers can craft malicious serialized digests containing NaN centroids that degrade sorting performance from O(n log n) to O(n squared), causing severe processing delays during merge operations.
Severity
CWE
- CWE-407 - Inefficient Algorithmic Complexity
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/tdunning/t-digest/issues/229 | issue-tracking |
| https://github.com/tdunning/t-digest/blob/8d5c152… | technical-description |
| https://github.com/tdunning/t-digest/blob/8d5c152… | technical-description |
| https://github.com/tdunning/t-digest | product |
| https://www.vulncheck.com/advisories/t-digest-3.1… | third-party-advisory |
Date Public
2026-08-24 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo1.maven.org/maven2/com/tdunning/t-digest/",
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/com.tdunning/t-digest",
"product": "t-digest",
"repo": "https://github.com/tdunning/t-digest",
"vendor": "tdunning",
"versions": [
{
"lessThanOrEqual": "3.3",
"status": "affected",
"version": "3.1",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yu Bao, PayPal Cyber Security Team"
}
],
"datePublic": "2026-08-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "t-digest versions 3.1 through 3.3 fail to validate centroid means during deserialization in MergingDigest.fromBytes, allowing attackers to inject NaN values that bypass validation checks. Attackers can craft malicious serialized digests containing NaN centroids that degrade sorting performance from O(n log n) to O(n squared), causing severe processing delays during merge operations."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-407",
"description": "Inefficient Algorithmic Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T14:32:42.726Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "tdunning/t-digest issue #229",
"tags": [
"issue-tracking"
],
"url": "https://github.com/tdunning/t-digest/issues/229"
},
{
"name": "fromBytes writing centroid means with no NaN check at the 3.3 release commit",
"tags": [
"technical-description"
],
"url": "https://github.com/tdunning/t-digest/blob/8d5c1523c3d46925e9b3979a8d63c0b9d004ed1c/core/src/main/java/com/tdunning/math/stats/MergingDigest.java"
},
{
"name": "stableQuickSort three-way partition that degrades on NaN at the 3.3 release commit",
"tags": [
"technical-description"
],
"url": "https://github.com/tdunning/t-digest/blob/8d5c1523c3d46925e9b3979a8d63c0b9d004ed1c/core/src/main/java/com/tdunning/math/stats/Sort.java"
},
{
"tags": [
"product"
],
"url": "https://github.com/tdunning/t-digest"
},
{
"name": "VulnCheck Advisory: t-digest 3.1 through 3.3 Denial of Service via NaN Centroid Means in MergingDigest.fromBytes",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/t-digest-3.1-through-3.3-denial-of-service-via-nan-centroid-means-in-mergingdigest-frombytes"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "t-digest 3.1 through 3.3 Denial of Service via NaN Centroid Means in MergingDigest.fromBytes",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-87822",
"datePublished": "2026-09-09T14:32:42.726Z",
"dateReserved": "2026-09-09T10:32:34.110Z",
"dateUpdated": "2026-09-09T14:32:42.726Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}