Threats tagged 'ghsa-p7mw-7cfx-cr67'

t-digest versions 3.1 through 3.3 have a denial of service vulnerability in the MergingDigest.fromBytes method. This flaw arises because the method does not properly validate the length and capacity fields from serialized input data. An attacker can craft serialized digests with mismatched header fields to cause exceptions that abort the parsing thread.