{"id":"CVE-2026-122096","summary":"Apache DataSketches Java: Uncontrolled resource consumption when deserializing crafted sketch images","details":"Uncontrolled Resource Consumption vulnerability in the sketch deserialization of Apache DataSketches Java.\n\n\n\nSeveral deserializers trusted sizes and counts declared in the serialized input. A small crafted input could make an application allocate an excessive amount of memory, leading to an OutOfMemoryError. A crafted string passed to FrequentLongsSketch.getInstance(String) could also make deserialization, or a later update, loop indefinitely. Only applications that deserialize sketches from untrusted sources are affected.\n\n\n\nThis issue affects Apache DataSketches Java: through 9.0.0.\n\n\n\nUsers are recommended to upgrade to version 9.1.0, which fixes the issue.","modified":"2026-11-14T07:06:19.617731933Z","published":"2026-11-11T12:13:53.275Z","database_specific":{"cna_assigner":"apache","cwe_ids":["CWE-400","CWE-789","CWE-835"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/122xxx/CVE-2026-122096.json"},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/11/10/29"},{"type":"WEB","url":"https://repo.maven.apache.org/maven2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/122xxx/CVE-2026-122096.json"},{"type":"ADVISORY","url":"https://github.com/apache/datasketches-java/releases/tag/9.1.0"},{"type":"ADVISORY","url":"https://lists.apache.org/thread/9wd7ngmho7hm8x74sq1p2fp1xgjd8kt6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122096"},{"type":"FIX","url":"https://github.com/apache/datasketches-java/pull/777"},{"type":"FIX","url":"https://github.com/apache/datasketches-java/pull/783"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apache/datasketches-java","events":[{"introduced":"0"},{"fixed":"d47c992b55c63d16c050711b3b9a0ac51b627031"}],"database_specific":{"extracted_events":[{"strategy":"StandardRange","range":[{"introduced":"0"},{"last_affected":"9.0.0"}],"source":"AFFECTED_FIELD"},{"range":[{"fixed":"d47c992b55c63d16c050711b3b9a0ac51b627031"}],"source":"REFERENCES_TAG","original_tag":"9.1.0"}]}}],"versions":["9.1.0-RC1","5.1.0-SNAPSHOT","4.1.0-SNAPSHOT","3.4.0-SNAPSHOT","3.2.0-SNAPSHOT","3.0.0","2.0.0-RC3","2.0.0","2.1.0-SNAPSHOT","PriorToRefactor","sketches-core-0.13.3","sketches-core-0.13.2","sketches-core-0.13.1","sketches-core-0.13.0","sketches-core-0.12.0","sketches-core-0.11.1","sketches-core-0.11.0","sketches-core-0.10.3","sketches-core-0.10.2","sketches-core-0.10.1","sketches-core-0.10.0","sketches-0.8.4","sketches-0.8.3","sketches-0.8.2","sketches-0.8.1","sketches-0.8.0","sketches-core-0.7.0","sketches-core-0.6.0","sketches-core-0.5.2","sketches-core-0.5.1","sketches-core-0.5.0","sketches-core-0.4.1","sketches-core-0.4.0","sketches-core-0.3.2","sketches-core-0.3.1","sketches-core-0.3.0","sketches-core-0.2.2","sketches-core-0.2.1","sketches-core-0.2.0","sketches-core-0.1.1","sketches-core-0.1.0"],"database_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://github.com/apache/datasketches-java/commit/d47c992b55c63d16c050711b3b9a0ac51b627031","target":{"file":"src/main/java/org/apache/datasketches/filters/xorfilter/XorFilter.java","function":"toString"},"deprecated":false,"digest":{"function_hash":"103562982749814191979619426063983712701","length":842},"id":"CVE-2026-122096-0549799d","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"50001451570719839708575874363903127923","length":266},"id":"CVE-2026-122096-0f7a07bd","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/datasketches-java/commit/d47c992b55c63d16c050711b3b9a0ac51b627031","target":{"file":"src/test/java/org/apache/datasketches/filters/xorfilter/XorFilterTest.java","function":"duplicateItemsTest"}},{"target":{"file":"src/test/java/org/apache/datasketches/filters/xorfilter/XorFilterTest.java","function":"gettersTest"},"deprecated":false,"digest":{"length":539,"function_hash":"191125129034864544779801636047225963235"},"id":"CVE-2026-122096-18e082ad","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/datasketches-java/commit/d47c992b55c63d16c050711b3b9a0ac51b627031"},{"id":"CVE-2026-122096-1b7a1c34","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/datasketches-java/commit/d47c992b55c63d16c050711b3b9a0ac51b627031","target":{"function":"builderNumItemsTest","file":"src/test/java/org/apache/datasketches/filters/xorfilter/XorFilterTest.java"},"deprecated":false,"digest":{"function_hash":"211052718488676904621362710015180374295","length":239}},{"id":"CVE-2026-122096-21171a67","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/datasketches-java/commit/d47c992b55c63d16c050711b3b9a0ac51b627031","target":{"file":"src/main/java/org/apache/datasketches/filters/xorfilter/XorFilter.java","function":"XorFilter"},"deprecated":false,"digest":{"function_hash":"333870412925742936258478243537339314994","length":257}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/datasketches-java/commit/d47c992b55c63d16c050711b3b9a0ac51b627031","target":{"file":"src/test/java/org/apache/datasketches/filters/xorfilter/XorFilterBenchmark.java"},"deprecated":false,"digest":{"line_hashes":["119700456223975766751018455474584780448","230219504334039343437989778921006946303","80436784459998379970170389385658200729","36339697231043630081857271887854505330"],"threshold":0.9},"id":"CVE-2026-122096-221277d6"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/datasketches-java/commit/d47c992b55c63d16c050711b3b9a0ac51b627031","target":{"file":"src/main/java/org/apache/datasketches/filters/xorfilter/XorFilter.java","function":"getNumItems"},"deprecated":false,"digest":{"function_hash":"82098241774422153519324035829683712871","length":40},"id":"CVE-2026-122096-2eee0849"},{"id":"CVE-2026-122096-4479da49","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/datasketches-java/commit/d47c992b55c63d16c050711b3b9a0ac51b627031","target":{"function":"XorFilter","file":"src/main/java/org/apache/datasketches/filters/xorfilter/XorFilter.java"},"deprecated":false,"digest":{"function_hash":"71092641504348921781383954328262731930","length":1232}},{"deprecated":false,"digest":{"length":342,"function_hash":"58557827983293521277086878409946757076"},"id":"CVE-2026-122096-5a1d1437","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/datasketches-java/commit/d47c992b55c63d16c050711b3b9a0ac51b627031","target":{"file":"src/test/java/org/apache/datasketches/filters/xorfilter/XorFilterTest.java","function":"emptyFilterTest"}},{"source":"https://github.com/apache/datasketches-java/commit/d47c992b55c63d16c050711b3b9a0ac51b627031","target":{"file":"src/main/java/org/apache/datasketches/filters/xorfilter/XorFilter.java","function":"internalHeapifyOrWrap"},"deprecated":false,"digest":{"length":2126,"function_hash":"249881363301467416341524466170603531280"},"id":"CVE-2026-122096-6cc3846c","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"244328251389469086297174695493793816260","length":353},"id":"CVE-2026-122096-71bbd9a4","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/datasketches-java/commit/d47c992b55c63d16c050711b3b9a0ac51b627031","target":{"file":"src/test/java/org/apache/datasketches/filters/xorfilter/XorFilterTest.java","function":"smallSetsTest"},"deprecated":false},{"id":"CVE-2026-122096-a2d90d2e","signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/datasketches-java/commit/d47c992b55c63d16c050711b3b9a0ac51b627031","target":{"file":"src/test/java/org/apache/datasketches/filters/xorfilter/XorFilterTest.java"},"deprecated":false,"digest":{"line_hashes":["131453212641056353617414377360128302328","31676676008031382448977163781270844300","15595080607202645075182380338002678161","55726460701676948228890157549913863841","69884719825096001166966943177871647501","267119715167728341294984818195747805000","64070809476213408763733883359950595136","319931037472537284669414311775321061400","13627403203619354447097927402325178895","210292392551863042214015794607466374729","305450403590664119861704371367210011429","186534320082901082127290220118839720029","25402265636784728518894395127216329837","289448781333843645630427205438239427466","100914462274560736845772958357449706610","314768498665460793732292946236643251924","120171943234022848139621097834574599751","190222163017971589918071580438483267583","87324983082828506903065955488798448188","306629275066032815657267628736869156710","212847576954245971286613661936043638959","205483524147868487515129863587163210661","104668592938900920001724302911750330701","24501234535006697431234705038672472381","297256861460483045516881601189523765972","101802696893589721502982344937780171765","97199018856125840224070367029351160545","86062541978470983293163822886263060035","79409165842688494490387394359547403635","65982708551356928374877629433588321327","230585477479010106807477415982188988049","253066758121595008613013174861821122104","104272029516700435182297203718442471535","209773820599831535241584255652741522635","95869268375664498059562764700135191659","92162859067392522076849710851224964831","161883677516187670558703432989538717332","263282883726273281082592388870838418828","197920572020077989461733925352844025997","140362490354098847094970534407646297781","73848490698698202516969464828974584508","303649975264826340901216302608761261446","160654027323973148378232595444902633458","169136539495068767517417729305478947316","79739387946970301846453965700210372382","141868339934602560298011863130575321182","2256556156604092206952109972991772096","129175525237755731423087273725304709653","130203039050155807661232505269599076826","100320941117576351585491810479793407981","81009021160539474314460273779607939780","320958998778448369232091884332567354140","337587480214444090772913943602681564179","133854574490442987031162890354042436546","157938909469446434493509340833156727273","68649119249054582980516941813995676667","255738954821795793569994477763839038882","127604922961826125279843885324282406191","89198280142003237939947770558761240359","329989198439551503848617092774163088455","178900197049129981694357313943783467735","281145033273553293974243605151131931681","124302557813187620826255771777010257312","222745176875204458572770931161525226441","330796094966998413194890245808466331800","93601905750176948163999226693367622800","276689856202643481467924560505174040900","107531511824227564092321574707657000701","268062154149371901011217432723887158451","98188114176362748188580694926151473996","2777733584936269073114917220754720283"],"threshold":0.9}},{"digest":{"function_hash":"33830195992277797227612353392561703875","length":355},"id":"CVE-2026-122096-c192a7e9","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/datasketches-java/commit/d47c992b55c63d16c050711b3b9a0ac51b627031","target":{"function":"referenceImplementationImageTest","file":"src/test/java/org/apache/datasketches/filters/xorfilter/XorFilterTest.java"},"deprecated":false},{"source":"https://github.com/apache/datasketches-java/commit/d47c992b55c63d16c050711b3b9a0ac51b627031","target":{"function":"getBitsPerItem","file":"src/main/java/org/apache/datasketches/filters/xorfilter/XorFilter.java"},"deprecated":false,"digest":{"function_hash":"89316809068875814387755897135212516080","length":129},"id":"CVE-2026-122096-c660f788","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-122096-d8563c03","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/datasketches-java/commit/d47c992b55c63d16c050711b3b9a0ac51b627031","target":{"file":"src/test/java/org/apache/datasketches/filters/xorfilter/XorFilterBenchmark.java","function":"measure"},"deprecated":false,"digest":{"function_hash":"291159804049152745412457685918291616478","length":955}},{"id":"CVE-2026-122096-d8ef3c79","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/datasketches-java/commit/d47c992b55c63d16c050711b3b9a0ac51b627031","target":{"function":"heapifyCorruptionBranchesTest","file":"src/test/java/org/apache/datasketches/filters/xorfilter/XorFilterTest.java"},"deprecated":false,"digest":{"function_hash":"39812630184006672826747665933400032546","length":692}},{"id":"CVE-2026-122096-da279db1","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/datasketches-java/commit/d47c992b55c63d16c050711b3b9a0ac51b627031","target":{"file":"src/main/java/org/apache/datasketches/filters/xorfilter/XorFilter.java","function":"writeToSegment"},"deprecated":false,"digest":{"function_hash":"174474247693719662443744404149157390947","length":601}},{"deprecated":false,"digest":{"function_hash":"106269131237013699299253790654873624420","length":45},"id":"CVE-2026-122096-db361a65","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/datasketches-java/commit/d47c992b55c63d16c050711b3b9a0ac51b627031","target":{"file":"src/main/java/org/apache/datasketches/filters/xorfilter/XorFilter.java","function":"isEmpty"}},{"signature_version":"v1","source":"https://github.com/apache/datasketches-java/commit/d47c992b55c63d16c050711b3b9a0ac51b627031","target":{"file":"src/test/java/org/apache/datasketches/filters/xorfilter/XorFilterTest.java","function":"heapifyRoundTripTest"},"deprecated":false,"digest":{"length":625,"function_hash":"215733452694334475309591080623132434151"},"id":"CVE-2026-122096-de2a2d11","signature_type":"Function"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/datasketches-java/commit/d47c992b55c63d16c050711b3b9a0ac51b627031","target":{"file":"src/main/java/org/apache/datasketches/filters/xorfilter/XorFilter.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["156683193514410648688524908852409549448","32020117608067494261541444837469409210","257717656461237304286052053134567361637","157798129562340421958344114574824280019","152693799048700480309856308215965109658","228173456243305991175623691291178185417","180030843773973950330281184305751452312","262925698038838420635954219771302193544","18931393044817844951059561980193670383","152015669808528388275992545247507477746","115068782672550137564067650018721962958","334427977872719359409451856636095874023","40340146664517921041183150363349955440","162115819450944590691242102398878957162","179601714522165835004488634767934339886","267638936148065156896017672701264587044","217957182157113565372820043250317059302","249906283921821040870417132516553179642","130456038431228315982164783931097541153","125167995922814060412678680648697941292","277840604270731983278351810331833621825","281164909738625590799161831221539441137","60589733952520648639090994534866298174","306033984581885974648239640404313788970","128401063057072912900878122929932956131","228218757894521249829304557585923966875","185755016161278230349420625133438836032","13218287875060676558433569410378873016","320396054857612902179618872992157661341","272910491919523811760357874960131071774","331834582904710709445250552746384072630","250241617092989372532324345127285439029","164239604609939467894085382106182218211","339430986751055056436094413485995425035","127996952740757483736201400315725811047","242472141365469664179542358092237098157","51417313105590974814299078565707977364","147332118208582080157868914735742892430","230878947669878284999744309837956528444","321189131691134612778173467211985577146","322649670207842698099100580558129901024","170704769617645132976466138356321567907","310111194007921787346635164016575030803","174549322875221611961469627875183986919","296405672811095524780358181030039159695","18829881187853399823565530935795205143","279654246377114935946367528548284004845","133987402008919075274744110883606750621","202346843433894228183940926510407323887","72243688662546371413996459515606559491","22798005578475846205132014828406452260","273680429971440311868393863223343484218","218107557613339981087040276982093577668","272967261531223190061750607388399168110","285563203452999768624784019992302830998","310631943198118333782391827325641066407","54268052788357865310074956242987808216","185554607590779399561341548710875152949","206800995059335034851639080966509920607","138010293175912909610405470849101142153","315883295399698479655925065687364408949","193473365374027085281625084301688627038","274771888669009966046045039102059710028","65911663558121537726270039492415378232","300825509849626052244214384995512904167","129567492260670853162644626853235815335","231334502717915249972735315435649230929","299288709814104184357085767688891313371","3634936511073276435325852452976521146","219177512042733926798699493026381250390","128676163324581453797731428308056011973","224590753872817957027224473595299414215","284248243366393031564145194383950463726","68516185532714786697010135477332839341","180823310008567672024974483560850651663","203368586059326459223089878698797754305","331606266898369244519100142098350923844"]},"id":"CVE-2026-122096-f3b26fbe"}],"vanir_signatures_modified":"2026-11-14T07:06:19Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-122096.json"}}],"schema_version":"1.9.2"}