The vulnerability in t-digest versions 3.1 to 3.3 arises from a failure to validate centroid means during deserialization in the MergingDigest.fromBytes method. Attackers can craft malicious serialized digests containing NaN centroid values that bypass validation, leading to inefficient algorithmic complexity. This causes sorting operations to degrade from O(n log n) to O(n squared), significantly impacting performance during merge operations.

An attacker can cause severe processing delays by injecting NaN centroid values into serialized digests, which degrade sorting performance during merge operations. This results in a denial of service condition due to inefficient algorithmic complexity, impacting availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted serialized digests or implement additional validation to detect and reject NaN centroid values during deserialization.