Apache DataSketches Java versions through 9.0.0 contain an uncontrolled resource consumption vulnerability in the sketch deserialization process. This flaw allows crafted inputs to cause excessive memory allocation leading to OutOfMemoryError or indefinite loops during deserialization or updates. Only applications deserializing sketches from untrusted sources are affected. The issue is fixed in version 9.1.0.