Apache Software Foundation Apache Datasketches vulnerabilities

CVE-2026-103501 [CRITICAL] CWE-122 CVE-2026-103501: Heap buffer overflow in the HLL sketch deserialization of Apache DataSketches C++ (repo: datasketche Heap buffer overflow in the HLL sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). When deserializing a sketch in LIST mode, from either a byte buffer or a stream, the coupon count was read from the input and used as the number of entries to copy into a fixed buffer of 8 entries, without checking it against the buffer's

CVE-2026-103513 [CRITICAL] CWE-125 CVE-2026-103513: Out-of-bounds read and write in the CPC sketch deserialization of Apache DataSketches C++ (repo: dat Out-of-bounds read and write in the CPC sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). A crafted serialized CPC sketch passed to cpc_sketch::deserialize(), from either a byte buffer or a stream, can cause the decompressor to read past the end of the compressed data, because the read position was only checked after d

CVE-2026-103635 [CRITICAL] CWE-125 CVE-2026-103635: Out-of-bounds read in the compact Theta sketch deserialization of Apache DataSketches C++ (repo: dat Out-of-bounds read in the compact Theta sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). compact_theta_sketch::deserialize() and wrapped_compact_theta_sketch::wrap() read header fields before checking that the input was long enough. For the compressed format, the size check could be defeated by a 32-bit overflow, and

CVE-2026-103636 [HIGH] CWE-125 CVE-2026-103636: Out-of-bounds read in the VarOpt union deserialization of Apache DataSketches C++ (repo: datasketche Out-of-bounds read in the VarOpt union deserialization of Apache DataSketches C++ (repo: datasketches-cpp). var_opt_union::deserialize() read the 32-byte preamble of a non-empty union after checking that only 8 bytes were available, so a truncated serialized union could cause a read of up to 24 bytes past the end of the input. For such inputs, the

CVE-2026-103634 [MEDIUM] CWE-190 CVE-2026-103634: Out-of-bounds read and write in the Count-Min sketch deserialization of Apache DataSketches C++ (rep Out-of-bounds read and write in the Count-Min sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). count_min_sketch::deserialize() did not include the preamble in its input size check, so a truncated sketch could cause a read of up to 16 bytes past the end of the input. In addition, the table size was computed from the seri