CVE-2026-122096

Not scored yetLast modified Nov 12, 2026

Description

Uncontrolled Resource Consumption vulnerability in the sketch deserialization of Apache DataSketches Java.

Several deserializers trusted sizes and counts declared in the serialized input. A small crafted input could make an application allocate an excessive amount of memory, leading to an OutOfMemoryError. A crafted string passed to FrequentLongsSketch.getInstance(String) could also make deserialization, or a later update, loop indefinitely. Only applications that deserialize sketches from untrusted sources are affected.

This issue affects Apache DataSketches Java: through 9.0.0.

Users are recommended to upgrade to version 9.1.0, which fixes the issue.

Metrics

No CVSS score has been published yet.

Weakness enumeration

CWE-400CWE-789CWE-835

Affected software

No affected versions have been published.

Timeline

Published
Nov 11, 2026
Last modified
Nov 12, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1220976.5CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. CVE-2026-1220985.1CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An aCVE-2026-1220992.9CAI Content Credentials is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker CVE-2026-12219.8PrismX MX100 AP controller developed by BROWAN COMMUNICATIONS has a Use of Hard-coded Credentials vulnerability, allowing unauthenticated rCVE-2026-122106.3A vulnerability was detected in universal-tool-calling-protocol python-utcp 1.1.0. This affects an unknown function of the component utcp-gqCVE-2026-1221005.5CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feaCVE-2026-1221013.7CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attackeCVE-2026-1221028.7Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject mCVE-2026-122112.7A flaw has been found in Intelbras iNVU 7016 FT 3.004.00IB000.0.T Build 2025-09-26. This impacts an unknown function of the file /RPC2_LoadfCVE-2026-1221134.3A vulnerability in Realtek's RtUsbA64.sys USB audio driver allows a physically present attacker using a maliciously crafted USB device to trCVE-2026-1221164.3Certain Yealink terminal devices before 2026-04-21 contain an improper access control vulnerability in the Wi-Fi 802.1X PEAP network configuCVE-2026-1221187.4In certain Yealink products before 2026-04-15, when the Wi-Fi AP function is enabled, a default 8-digit numeric PSK with insufficient streng
CVE-2026-122096: Unscored | Vulnix