CVE-2026-14683: HdrHistogram Memory Allocation Vulnerability – Local DoS Risk

Technical summary

The vulnerability resides in the decodeFromCompressedByteBuffer method of AbstractHistogram.java. The flaw allows an unauthenticated local user to trigger uncontrolled memory allocation by manipulating the lengthOfCompressedContents parameter during decompression. This maps to CWE-400 (Uncontrolled Resource Consumption) and CWE-789 (Memory Allocation with Excessive Size Value). The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) indicates local access, low complexity, and low-privilege requirement, with impact limited to availability.

Business impact

Organizations using HdrHistogram for performance monitoring and latency tracking face potential service disruption if a local attacker exploits this to exhaust memory. The impact is primarily operational availability rather than data confidentiality or integrity. Risk is most acute in multi-tenant or shared-resource environments where untrusted local users have access to applications consuming HdrHistogram.

Affected systems

HdrHistogram library versions up to and including 2.2.2 are affected. The vulnerability requires local system access, making it relevant primarily to server applications, containerized workloads, and development environments where HdrHistogram is integrated for metrics collection and histogram recording.

Exploitability

Public exploit information is available, which increases awareness and potential attack surface. However, practical exploitation requires local system access and knowledge of application-specific entry points that feed untrusted data to the vulnerable decompression function. The dispute within the security community regarding whether this crosses a meaningful security boundary reflects uncertainty about realistic attack scenarios and prerequisite conditions.

Remediation

Update HdrHistogram to a version beyond 2.2.2 that addresses the memory allocation issue. Verify the patched version through vendor release notes. Additionally, restrict local system access through operating system controls, containerization, and principle of least privilege to reduce the attack surface.

Patch guidance

Monitor HdrHistogram release channels and Maven Central for updates addressing CVE-2026-14683. When available, test patched versions in a non-production environment to validate compatibility with your application. Review your dependency management tooling (Gradle, Maven) to facilitate rapid updates across your infrastructure.

Detection guidance

Monitor for unexpected memory consumption spikes in applications using HdrHistogram, particularly correlation with processing of compressed histogram data. Log and alert on unusual decompression operations. Application profilers and memory monitoring tools can help identify anomalous allocation patterns. Network-based detection is limited due to the local-only attack vector.

Why prioritize this

This vulnerability warrants moderate attention but not immediate emergency action. The low CVSS score (3.3), local-only attack vector, and disputed security significance lower urgency. However, public exploit availability and availability impact merit timely remediation within a standard patch cycle, especially in shared-access or multi-tenant environments.

Risk score, explained

The CVSS 3.1 score of 3.3 (LOW) reflects limited exploitability scope. Local access is required, privilege escalation is not possible, and the impact is confined to availability—no confidentiality or integrity compromise. The disputed nature of the boundary crossing further constrains the practical risk profile, though organizations should not dismiss it entirely.

Frequently asked questions