CVE-2026-122096

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-122096
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-122096.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-122096
Published
2026-11-11T12:13:53Z
Modified
2026-11-14T07:06:19Z
Summary
Apache DataSketches Java: Uncontrolled resource consumption when deserializing crafted sketch images
Details

Uncontrolled Resource Consumption vulnerability in the sketch deserialization of Apache DataSketches Java.

Several deserializers trusted sizes and counts declared in the serialized input. A small crafted input could make an application allocate an excessive amount of memory, leading to an OutOfMemoryError. A crafted string passed to FrequentLongsSketch.getInstance(String) could also make deserialization, or a later update, loop indefinitely. Only applications that deserialize sketches from untrusted sources are affected.

This issue affects Apache DataSketches Java: through 9.0.0.

Users are recommended to upgrade to version 9.1.0, which fixes the issue.

Database specific 
{
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-400",
        "CWE-789",
        "CWE-835"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/122xxx/CVE-2026-122096.json"
}
References

Affected packages

Git / github.com/apache/datasketches-java

Affected ranges

Type
GIT
Repo
https://github.com/apache/datasketches-java
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
d47c992b55c63d16c050711b3b9a0ac51b627031
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "last_affected": "9.0.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "original_tag": "9.1.0",
            "range": [
                {
                    "fixed": "d47c992b55c63d16c050711b3b9a0ac51b627031"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

2.*
2.0.0
2.0.0-RC3
2.1.0-SNAPSHOT
3.*
3.0.0
3.2.0-SNAPSHOT
3.4.0-SNAPSHOT
4.*
4.1.0-SNAPSHOT
5.*
5.1.0-SNAPSHOT
9.*
9.1.0-RC1
Other
PriorToRefactor
sketches-0.*
sketches-0.8.0
sketches-0.8.1
sketches-0.8.2
sketches-0.8.3
sketches-0.8.4
sketches-core-0.*
sketches-core-0.1.0
sketches-core-0.1.1
sketches-core-0.10.0
sketches-core-0.10.1
sketches-core-0.10.2
sketches-core-0.10.3
sketches-core-0.11.0
sketches-core-0.11.1
sketches-core-0.12.0
sketches-core-0.13.0
sketches-core-0.13.1
sketches-core-0.13.2
sketches-core-0.13.3
sketches-core-0.2.0
sketches-core-0.2.1
sketches-core-0.2.2
sketches-core-0.3.0
sketches-core-0.3.1
sketches-core-0.3.2
sketches-core-0.4.0
sketches-core-0.4.1
sketches-core-0.5.0
sketches-core-0.5.1
sketches-core-0.5.2
sketches-core-0.6.0
sketches-core-0.7.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-122096.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "103562982749814191979619426063983712701",
            "length": 842
        },
        "id": "CVE-2026-122096-0549799d",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/apache/datasketches-java/commit/d47c992b55c63d16c050711b3b9a0ac51b627031",
        "target": {
            "file": "src/main/java/org/apache/datasketches/filters/xorfilter/XorFilter.java",
            "function": "toString"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "50001451570719839708575874363903127923",
            "length": 266
        },
        "id": "CVE-2026-122096-0f7a07bd",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/apache/datasketches-java/commit/d47c992b55c63d16c050711b3b9a0ac51b627031",
        "target": {
            "file": "src/test/java/org/apache/datasketches/filters/xorfilter/XorFilterTest.java",
            "function": "duplicateItemsTest"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "191125129034864544779801636047225963235",
            "length": 539
        },
        "id": "CVE-2026-122096-18e082ad",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/apache/datasketches-java/commit/d47c992b55c63d16c050711b3b9a0ac51b627031",
        "target": {
            "file": "src/test/java/org/apache/datasketches/filters/xorfilter/XorFilterTest.java",
            "function": "gettersTest"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "211052718488676904621362710015180374295",
            "length": 239
        },
        "id": "CVE-2026-122096-1b7a1c34",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/apache/datasketches-java/commit/d47c992b55c63d16c050711b3b9a0ac51b627031",
        "target": {
            "file": "src/test/java/org/apache/datasketches/filters/xorfilter/XorFilterTest.java",
            "function": "builderNumItemsTest"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "333870412925742936258478243537339314994",
            "length": 257
        },
        "id": "CVE-2026-122096-21171a67",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/apache/datasketches-java/commit/d47c992b55c63d16c050711b3b9a0ac51b627031",
        "target": {
            "file": "src/main/java/org/apache/datasketches/filters/xorfilter/XorFilter.java",
            "function": "XorFilter"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "119700456223975766751018455474584780448",
                "230219504334039343437989778921006946303",
                "80436784459998379970170389385658200729",
                "36339697231043630081857271887854505330"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-122096-221277d6",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/apache/datasketches-java/commit/d47c992b55c63d16c050711b3b9a0ac51b627031",
        "target": {
            "file": "src/test/java/org/apache/datasketches/filters/xorfilter/XorFilterBenchmark.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "82098241774422153519324035829683712871",
            "length": 40
        },
        "id": "CVE-2026-122096-2eee0849",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/apache/datasketches-java/commit/d47c992b55c63d16c050711b3b9a0ac51b627031",
        "target": {
            "file": "src/main/java/org/apache/datasketches/filters/xorfilter/XorFilter.java",
            "function": "getNumItems"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "71092641504348921781383954328262731930",
            "length": 1232
        },
        "id": "CVE-2026-122096-4479da49",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/apache/datasketches-java/commit/d47c992b55c63d16c050711b3b9a0ac51b627031",
        "target": {
            "file": "src/main/java/org/apache/datasketches/filters/xorfilter/XorFilter.java",
            "function": "XorFilter"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "58557827983293521277086878409946757076",
            "length": 342
        },
        "id": "CVE-2026-122096-5a1d1437",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/apache/datasketches-java/commit/d47c992b55c63d16c050711b3b9a0ac51b627031",
        "target": {
            "file": "src/test/java/org/apache/datasketches/filters/xorfilter/XorFilterTest.java",
            "function": "emptyFilterTest"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "249881363301467416341524466170603531280",
            "length": 2126
        },
        "id": "CVE-2026-122096-6cc3846c",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/apache/datasketches-java/commit/d47c992b55c63d16c050711b3b9a0ac51b627031",
        "target": {
            "file": "src/main/java/org/apache/datasketches/filters/xorfilter/XorFilter.java",
            "function": "internalHeapifyOrWrap"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "244328251389469086297174695493793816260",
            "length": 353
        },
        "id": "CVE-2026-122096-71bbd9a4",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/apache/datasketches-java/commit/d47c992b55c63d16c050711b3b9a0ac51b627031",
        "target": {
            "file": "src/test/java/org/apache/datasketches/filters/xorfilter/XorFilterTest.java",
            "function": "smallSetsTest"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "131453212641056353617414377360128302328",
                "31676676008031382448977163781270844300",
                "15595080607202645075182380338002678161",
                "55726460701676948228890157549913863841",
                "69884719825096001166966943177871647501",
                "267119715167728341294984818195747805000",
                "64070809476213408763733883359950595136",
                "319931037472537284669414311775321061400",
                "13627403203619354447097927402325178895",
                "210292392551863042214015794607466374729",
                "305450403590664119861704371367210011429",
                "186534320082901082127290220118839720029",
                "25402265636784728518894395127216329837",
                "289448781333843645630427205438239427466",
                "100914462274560736845772958357449706610",
                "314768498665460793732292946236643251924",
                "120171943234022848139621097834574599751",
                "190222163017971589918071580438483267583",
                "87324983082828506903065955488798448188",
                "306629275066032815657267628736869156710",
                "212847576954245971286613661936043638959",
                "205483524147868487515129863587163210661",
                "104668592938900920001724302911750330701",
                "24501234535006697431234705038672472381",
                "297256861460483045516881601189523765972",
                "101802696893589721502982344937780171765",
                "97199018856125840224070367029351160545",
                "86062541978470983293163822886263060035",
                "79409165842688494490387394359547403635",
                "65982708551356928374877629433588321327",
                "230585477479010106807477415982188988049",
                "253066758121595008613013174861821122104",
                "104272029516700435182297203718442471535",
                "209773820599831535241584255652741522635",
                "95869268375664498059562764700135191659",
                "92162859067392522076849710851224964831",
                "161883677516187670558703432989538717332",
                "263282883726273281082592388870838418828",
                "197920572020077989461733925352844025997",
                "140362490354098847094970534407646297781",
                "73848490698698202516969464828974584508",
                "303649975264826340901216302608761261446",
                "160654027323973148378232595444902633458",
                "169136539495068767517417729305478947316",
                "79739387946970301846453965700210372382",
                "141868339934602560298011863130575321182",
                "2256556156604092206952109972991772096",
                "129175525237755731423087273725304709653",
                "130203039050155807661232505269599076826",
                "100320941117576351585491810479793407981",
                "81009021160539474314460273779607939780",
                "320958998778448369232091884332567354140",
                "337587480214444090772913943602681564179",
                "133854574490442987031162890354042436546",
                "157938909469446434493509340833156727273",
                "68649119249054582980516941813995676667",
                "255738954821795793569994477763839038882",
                "127604922961826125279843885324282406191",
                "89198280142003237939947770558761240359",
                "329989198439551503848617092774163088455",
                "178900197049129981694357313943783467735",
                "281145033273553293974243605151131931681",
                "124302557813187620826255771777010257312",
                "222745176875204458572770931161525226441",
                "330796094966998413194890245808466331800",
                "93601905750176948163999226693367622800",
                "276689856202643481467924560505174040900",
                "107531511824227564092321574707657000701",
                "268062154149371901011217432723887158451",
                "98188114176362748188580694926151473996",
                "2777733584936269073114917220754720283"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-122096-a2d90d2e",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/apache/datasketches-java/commit/d47c992b55c63d16c050711b3b9a0ac51b627031",
        "target": {
            "file": "src/test/java/org/apache/datasketches/filters/xorfilter/XorFilterTest.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "33830195992277797227612353392561703875",
            "length": 355
        },
        "id": "CVE-2026-122096-c192a7e9",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/apache/datasketches-java/commit/d47c992b55c63d16c050711b3b9a0ac51b627031",
        "target": {
            "file": "src/test/java/org/apache/datasketches/filters/xorfilter/XorFilterTest.java",
            "function": "referenceImplementationImageTest"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "89316809068875814387755897135212516080",
            "length": 129
        },
        "id": "CVE-2026-122096-c660f788",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/apache/datasketches-java/commit/d47c992b55c63d16c050711b3b9a0ac51b627031",
        "target": {
            "file": "src/main/java/org/apache/datasketches/filters/xorfilter/XorFilter.java",
            "function": "getBitsPerItem"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "291159804049152745412457685918291616478",
            "length": 955
        },
        "id": "CVE-2026-122096-d8563c03",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/apache/datasketches-java/commit/d47c992b55c63d16c050711b3b9a0ac51b627031",
        "target": {
            "file": "src/test/java/org/apache/datasketches/filters/xorfilter/XorFilterBenchmark.java",
            "function": "measure"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "39812630184006672826747665933400032546",
            "length": 692
        },
        "id": "CVE-2026-122096-d8ef3c79",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/apache/datasketches-java/commit/d47c992b55c63d16c050711b3b9a0ac51b627031",
        "target": {
            "file": "src/test/java/org/apache/datasketches/filters/xorfilter/XorFilterTest.java",
            "function": "heapifyCorruptionBranchesTest"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "174474247693719662443744404149157390947",
            "length": 601
        },
        "id": "CVE-2026-122096-da279db1",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/apache/datasketches-java/commit/d47c992b55c63d16c050711b3b9a0ac51b627031",
        "target": {
            "file": "src/main/java/org/apache/datasketches/filters/xorfilter/XorFilter.java",
            "function": "writeToSegment"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "106269131237013699299253790654873624420",
            "length": 45
        },
        "id": "CVE-2026-122096-db361a65",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/apache/datasketches-java/commit/d47c992b55c63d16c050711b3b9a0ac51b627031",
        "target": {
            "file": "src/main/java/org/apache/datasketches/filters/xorfilter/XorFilter.java",
            "function": "isEmpty"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "215733452694334475309591080623132434151",
            "length": 625
        },
        "id": "CVE-2026-122096-de2a2d11",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/apache/datasketches-java/commit/d47c992b55c63d16c050711b3b9a0ac51b627031",
        "target": {
            "file": "src/test/java/org/apache/datasketches/filters/xorfilter/XorFilterTest.java",
            "function": "heapifyRoundTripTest"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "156683193514410648688524908852409549448",
                "32020117608067494261541444837469409210",
                "257717656461237304286052053134567361637",
                "157798129562340421958344114574824280019",
                "152693799048700480309856308215965109658",
                "228173456243305991175623691291178185417",
                "180030843773973950330281184305751452312",
                "262925698038838420635954219771302193544",
                "18931393044817844951059561980193670383",
                "152015669808528388275992545247507477746",
                "115068782672550137564067650018721962958",
                "334427977872719359409451856636095874023",
                "40340146664517921041183150363349955440",
                "162115819450944590691242102398878957162",
                "179601714522165835004488634767934339886",
                "267638936148065156896017672701264587044",
                "217957182157113565372820043250317059302",
                "249906283921821040870417132516553179642",
                "130456038431228315982164783931097541153",
                "125167995922814060412678680648697941292",
                "277840604270731983278351810331833621825",
                "281164909738625590799161831221539441137",
                "60589733952520648639090994534866298174",
                "306033984581885974648239640404313788970",
                "128401063057072912900878122929932956131",
                "228218757894521249829304557585923966875",
                "185755016161278230349420625133438836032",
                "13218287875060676558433569410378873016",
                "320396054857612902179618872992157661341",
                "272910491919523811760357874960131071774",
                "331834582904710709445250552746384072630",
                "250241617092989372532324345127285439029",
                "164239604609939467894085382106182218211",
                "339430986751055056436094413485995425035",
                "127996952740757483736201400315725811047",
                "242472141365469664179542358092237098157",
                "51417313105590974814299078565707977364",
                "147332118208582080157868914735742892430",
                "230878947669878284999744309837956528444",
                "321189131691134612778173467211985577146",
                "322649670207842698099100580558129901024",
                "170704769617645132976466138356321567907",
                "310111194007921787346635164016575030803",
                "174549322875221611961469627875183986919",
                "296405672811095524780358181030039159695",
                "18829881187853399823565530935795205143",
                "279654246377114935946367528548284004845",
                "133987402008919075274744110883606750621",
                "202346843433894228183940926510407323887",
                "72243688662546371413996459515606559491",
                "22798005578475846205132014828406452260",
                "273680429971440311868393863223343484218",
                "218107557613339981087040276982093577668",
                "272967261531223190061750607388399168110",
                "285563203452999768624784019992302830998",
                "310631943198118333782391827325641066407",
                "54268052788357865310074956242987808216",
                "185554607590779399561341548710875152949",
                "206800995059335034851639080966509920607",
                "138010293175912909610405470849101142153",
                "315883295399698479655925065687364408949",
                "193473365374027085281625084301688627038",
                "274771888669009966046045039102059710028",
                "65911663558121537726270039492415378232",
                "300825509849626052244214384995512904167",
                "129567492260670853162644626853235815335",
                "231334502717915249972735315435649230929",
                "299288709814104184357085767688891313371",
                "3634936511073276435325852452976521146",
                "219177512042733926798699493026381250390",
                "128676163324581453797731428308056011973",
                "224590753872817957027224473595299414215",
                "284248243366393031564145194383950463726",
                "68516185532714786697010135477332839341",
                "180823310008567672024974483560850651663",
                "203368586059326459223089878698797754305",
                "331606266898369244519100142098350923844"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-122096-f3b26fbe",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/apache/datasketches-java/commit/d47c992b55c63d16c050711b3b9a0ac51b627031",
        "target": {
            "file": "src/main/java/org/apache/datasketches/filters/xorfilter/XorFilter.java"
        }
    }
]
vanir_signatures_modified 
"2026-11-14T07:06:19Z"