CVE-2026-14683

Advisory lineage Upstream: 0 Downstream: 4
PUBLISHED
Published: 04 Jul 2026, 23:00
Last modified:16 Jul 2026, 07:18

Vulnerability Summary

Overall Risk (default)
medium
29/100
CVSS Score
4.8 MEDIUM
v4.0 (cve.org)
EPSS Score
0.12% LOW
0% probability
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

04 Jul 2026, 23:00
Published
Vulnerability first disclosed
16 Jul 2026, 07:18
Last Modified
Vulnerability information updated

Description

A vulnerability was detected in HdrHistogram up to 2.2.2. Affected by this issue is the function org.HdrHistogram.AbstractHistogram.decodeFromCompressedByteBuffer of the file src/main/java/org/HdrHistogram/AbstractHistogram.java. The manipulation of the argument lengthOfCompressedContents results in uncontrolled memory allocation. The attack needs to be approached locally. The exploit is now public and may be used. It is still unclear if this vulnerability genuinely exists. This issue is disputed due to the potential lack of crossing of security boundaries and the pre-requisites for a successful attack.

CVSS Metrics

  • v4.0•MEDIUM•Score: 4.8CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
  • v3.1•LOW•Score: 3.3CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R
  • v3.0•LOW•Score: 3.3CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R
  • v2.0•LOW•Score: 1.7AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR

EPSS Trends

Current EPSS score: 0.12%• Percentile: 2%

Techniques & Countermeasures

  • CWE-789•Memory Allocation with Excessive Size Value

    The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

  • CWE-400•Uncontrolled Resource Consumption

    The product does not properly control the allocation and maintenance of a limited resource.

References (7)