CVE-2026-87822
t-digest 3.1 through 3.3 Denial of Service via NaN Centroid Means in MergingDigest.fromBytes
- State
- Published
- Severity
- 8.7 High
- Published
- Sep 9, 2026
- Updated
- Sep 10, 2026
- Reserved
- Sep 9, 2026
Description
t-digest versions 3.1 through 3.3 fail to validate centroid means during deserialization in MergingDigest.fromBytes, allowing attackers to inject NaN values that bypass validation checks. Attackers can craft malicious serialized digests containing NaN centroids that degrade sorting performance from O(n log n) to O(n squared), causing severe processing delays during merge operations.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | VulnCheck |
Weaknesses
- CWE-407 Inefficient Algorithmic Complexity
Affected Products
| Product | Versions |
|---|---|
t-digesttdunning |
|
References
- tdunning/t-digest issue #229issue-tracking
- fromBytes writing centroid means with no NaN check at the 3.3 release committechnical-description
- stableQuickSort three-way partition that degrades on NaN at the 3.3 release committechnical-description
- https://github.com/tdunning/t-digestproduct
- VulnCheck Advisory: t-digest 3.1 through 3.3 Denial of Service via NaN Centroid Means in MergingDigest.fromBytesthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.