Uncontrolled Memory Allocation in HdrHistogram (CVE-2026-14684)
CVE-2026-14684 is a medium severity vulnerability in HdrHistogram versions 2.2.0, 2.2.1, and 2.2.2. It involves uncontrolled memory allocation in the decodeFromByteBuffer function due to manipulation of the numberOfSignificantValueDigits argument. The attack requires local access and no user interaction. The existence of the vulnerability is disputed because it may not cross security boundaries and has specific prerequisites. No official patch or fix is currently documented.
AI Analysis
Technical Summary
This vulnerability affects the HdrHistogram library up to version 2.2.2 in the function org.HdrHistogram.AbstractHistogram.decodeFromByteBuffer. The issue arises from improper handling of the numberOfSignificantValueDigits parameter, leading to uncontrolled memory allocation. Exploitation requires local access with low privileges and does not require user interaction. The vulnerability has a CVSS 4.8 (medium) score and is associated with CWE-789 (Uncontrolled Memory Allocation) and CWE-400 (Uncontrolled Resource Consumption). The actual impact and exploitability are disputed due to the attack's local nature and potential lack of crossing security boundaries. No patch or official remediation has been provided by the vendor as of the published date.
Potential Impact
If exploited, this vulnerability could cause excessive memory allocation on the affected system, potentially leading to resource exhaustion or denial of service. However, exploitation requires local access and low privileges, limiting the attack surface. The vulnerability's practical impact is uncertain due to disputes about its existence and the attack prerequisites.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory RHSA-2026:26989 for current remediation guidance. Since no official patch or fix is documented, monitor the vendor's security advisories for updates. Given the local attack requirement, restrict local access to trusted users and environments as a precaution.
Uncontrolled Memory Allocation in HdrHistogram (CVE-2026-14684)
Description
CVE-2026-14684 is a medium severity vulnerability in HdrHistogram versions 2.2.0, 2.2.1, and 2.2.2. It involves uncontrolled memory allocation in the decodeFromByteBuffer function due to manipulation of the numberOfSignificantValueDigits argument. The attack requires local access and no user interaction. The existence of the vulnerability is disputed because it may not cross security boundaries and has specific prerequisites. No official patch or fix is currently documented.
CVSS v4.0
Score 4.8medium
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects the HdrHistogram library up to version 2.2.2 in the function org.HdrHistogram.AbstractHistogram.decodeFromByteBuffer. The issue arises from improper handling of the numberOfSignificantValueDigits parameter, leading to uncontrolled memory allocation. Exploitation requires local access with low privileges and does not require user interaction. The vulnerability has a CVSS 4.8 (medium) score and is associated with CWE-789 (Uncontrolled Memory Allocation) and CWE-400 (Uncontrolled Resource Consumption). The actual impact and exploitability are disputed due to the attack's local nature and potential lack of crossing security boundaries. No patch or official remediation has been provided by the vendor as of the published date.
Potential Impact
If exploited, this vulnerability could cause excessive memory allocation on the affected system, potentially leading to resource exhaustion or denial of service. However, exploitation requires local access and low privileges, limiting the attack surface. The vulnerability's practical impact is uncertain due to disputes about its existence and the attack prerequisites.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory RHSA-2026:26989 for current remediation guidance. Since no official patch or fix is documented, monitor the vendor's security advisories for updates. Given the local attack requirement, restrict local access to trusted users and environments as a precaution.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:26989
- Cve Count
- 1
- Additional Cves
- []
- Cvss Version
- null
Threat ID: 6a4e4ebfc9d9e3dbe3285ec3
Added to database: 07/08/2026, 13:21:03 UTC
Last enriched: 07/16/2026, 15:00:09 UTC
Last updated: 07/31/2026, 19:24:47 UTC
Views: 57
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.