CVE-2026-14684

Advisory lineage Upstream: 0 Downstream: 4
PUBLISHED
Published: 04 Jul 2026, 23:30
Last modified:16 Jul 2026, 07:18

Vulnerability Summary

Overall Risk (default)
medium
29/100
CVSS Score
4.8 MEDIUM
v4.0 (cve.org)
EPSS Score
0.12% LOW
0% probability
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

04 Jul 2026, 23:30
Published
Vulnerability first disclosed
16 Jul 2026, 07:18
Last Modified
Vulnerability information updated

Description

A flaw has been found in HdrHistogram up to 2.2.2. This affects the function org.HdrHistogram.AbstractHistogram.decodeFromByteBuffer of the file src/main/java/org/HdrHistogram/AbstractHistogram.java. This manipulation of the argument numberOfSignificantValueDigits causes uncontrolled memory allocation. The attack can only be executed locally. The exploit has been published and may be used. The actual existence of this vulnerability is currently in question. This issue is disputed due to the potential lack of crossing of security boundaries and the pre-requisites for a successful attack.

CVSS Metrics

  • v4.0•MEDIUM•Score: 4.8CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
  • v3.1•LOW•Score: 3.3CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R
  • v3.0•LOW•Score: 3.3CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R
  • v2.0•LOW•Score: 1.7AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR

EPSS Trends

Current EPSS score: 0.12%• Percentile: 2%

Techniques & Countermeasures

  • CWE-789•Memory Allocation with Excessive Size Value

    The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

  • CWE-400•Uncontrolled Resource Consumption

    The product does not properly control the allocation and maintenance of a limited resource.

References (6)