CVE-2026-14685: HdrHistogram AbstractHistogram State Issue (Local)

Technical summary

CVE-2026-14685 affects HdrHistogram through version 2.2.2 in the recordValueWithCount function of src/main/java/org/HdrHistogram/AbstractHistogram.java. The vulnerability stems from improper handling of the Count parameter, which can trigger a state issue in the histogram data structure. The attack vector is local (AV:L), requires low complexity (AC:L), and demands low privileges (PR:L), with no user interaction required. The CVSS 3.1 score of 3.3 (LOW) reflects limited impact: integrity is compromised but confidentiality and availability are not affected. The issue falls under CWE-371 (Undefined Behavior).

Business impact

Organizations using HdrHistogram in production environments should assess exposure, though the practical risk is limited. Since exploitation requires local system access and valid user credentials, the threat model is constrained to insider threats or lateral movement scenarios post-compromise. Applications relying on histogram accuracy for performance monitoring or SLA tracking could produce corrupted metrics if attacked, potentially masking real performance issues. However, this is unlikely to enable further system compromise or data exfiltration.

Affected systems

HdrHistogram versions up to and including 2.2.2 are affected. The library is used in Java applications for recording and analyzing latency distributions; common use cases include monitoring, performance telemetry, and statistical analysis. No specific vendor products are enumerated in known advisories at this time. Check your build dependencies (Maven, Gradle) for HdrHistogram presence and version.

Exploitability

Exploitation requires local system access and valid user credentials on the target machine. A public disclosure exists, making the attack technique accessible, yet actual exploitation attempts remain rare or unreported. The disputed nature of the vulnerability—centered on whether the state issue crosses meaningful security boundaries—reflects genuine uncertainty in the community about real-world impact under typical deployment conditions.

Remediation

Upgrade HdrHistogram to a version newer than 2.2.2 once a patched release is available. Verify the patch version against the vendor's official release notes. In the interim, restrict local user access and monitor use of histogram recording functions. Consider whether your application's threat model (insider risk vs. external-only) warrants immediate action.

Patch guidance

Check HdrHistogram's official GitHub repository (https://github.com/HdrHistogram/HdrHistogram) and Maven Central for release notes detailing the fix. Apply updates through your dependency management tool (Maven, Gradle, etc.). Test thoroughly in a staging environment, as histogram state corruption could affect monitoring or alerting systems that depend on accurate data. Verify the patched version resolves the issue per vendor documentation before production rollout.

Detection guidance

Monitor local user activity and privilege escalation attempts on systems running HdrHistogram. Check application logs for unexpected state errors or exceptions from the AbstractHistogram class. If you have Java application performance monitoring in place, look for anomalies in recorded histogram values (e.g., sudden spikes, invalid counts, or state exceptions). Endpoint detection tools can flag suspicious attempts to modify histogram behavior via local execution.

Why prioritize this

This vulnerability is low-severity and disputed in nature, making it lower priority than critical or high-severity flaws. However, it should not be ignored: if your applications depend on histogram accuracy for SLA monitoring or performance-based alerting, ensure timely patching once a fix is released. Prioritize based on deployment sensitivity and insider threat risk rather than CVSS score alone.

Risk score, explained

The CVSS 3.1 score of 3.3 reflects the constrained attack surface: local-only access, authentication required, and integrity impact only (no confidentiality or availability loss). The dispute within the security community further reduces practical risk, as the boundary-crossing question suggests the issue may not materially compromise the system in typical use. However, organizations deploying HdrHistogram for critical performance monitoring should treat this as moderate housekeeping priority, not an emergency.

Frequently asked questions