{"affected":[{"defaultStatus":"unaffected","ecosystem":"maven","packageName":"org.apache.datasketches:datasketches-java","product":"Apache DataSketches Java","source":"CNA: apache","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"9.0.0","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-122096","cwes":["CWE-400","CWE-789","CWE-835"],"description":"Uncontrolled Resource Consumption vulnerability in the sketch deserialization of Apache DataSketches Java.\n\n\n\nSeveral deserializers trusted sizes and counts declared in the serialized input. A small crafted input could make an application allocate an excessive amount of memory, leading to an OutOfMemoryError. A crafted string passed to FrequentLongsSketch.getInstance(String) could also make deserialization, or a later update, loop indefinitely. Only applications that deserialize sketches from untrusted sources are affected.\n\n\n\nThis issue affects Apache DataSketches Java: through 9.0.0.\n\n\n\nUsers are recommended to upgrade to version 9.1.0, which fixes the issue.","epss":null,"exploits":[],"kev":null,"metrics":[],"modifiedAt":1794402563609,"publishedAt":1794399233275,"references":[{"source":"CNA: apache","tags":["release-notes"],"url":"https://github.com/apache/datasketches-java/releases/tag/9.1.0"},{"source":"CNA: apache","tags":["patch"],"url":"https://github.com/apache/datasketches-java/pull/777"},{"source":"CNA: apache","tags":["patch"],"url":"https://github.com/apache/datasketches-java/pull/783"},{"source":"CNA: apache","tags":["vendor-advisory"],"url":"https://lists.apache.org/thread/9wd7ngmho7hm8x74sq1p2fp1xgjd8kt6"},{"source":"ADP: CVE","tags":[],"url":"http://www.openwall.com/lists/oss-security/2026/11/10/29"}],"remediation":[{"kind":"fix","source":"CNA: apache","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/apache/datasketches-java/pull/777"},{"kind":"fix","source":"CNA: apache","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/apache/datasketches-java/pull/783"}],"revision":"2c30f4f8a86fa5163d006fd02a828b9ed35309b8eb02fbde80628920082072cb","sources":[{"modifiedAt":1794402563609,"name":"CNA: apache","retrievedAt":1794406125663,"url":"https://www.cve.org/CVERecord?id=CVE-2026-122096"}],"ssvc":null,"status":"published","title":"Apache DataSketches Java: Uncontrolled resource consumption when deserializing crafted sketch images","updatedAt":1794406125663}