CVE-2026-14686: HdrHistogram Range Check Integer Comparison Flaw – Local Access Required

Technical summary

The vulnerability resides in org.HdrHistogram.DoubleHistogram.recordValue within src/main/java/org/HdrHistogram/DoubleHistogram.java. The component implements range validation for histogram value recording, but a faulty comparison operation allows the range check to produce incorrect results. An attacker with local shell or application-level access could supply input values that fail to be properly validated, potentially causing the histogram to record or process values outside their intended bounds. The flaw maps to CWE-697 (Incorrect Comparison), indicating a logic error rather than a memory safety or injection vulnerability. HdrHistogram versions up to 2.2.2 are affected.

Business impact

Organizations using HdrHistogram as a dependency in Java applications should evaluate whether data integrity of recorded metrics is a security concern in their context. In monitoring, observability, and performance measurement scenarios, histogram poisoning could lead to misleading performance baselines or alerts. However, the impact is confined to the accuracy of latency/distribution data—it does not grant unauthorized access to systems or sensitive data. Applications that rely on HdrHistogram's metrics for real-time decision-making (e.g., auto-scaling triggers based on latency percentiles) may experience subtle degradation in decision quality if an attacker with local access deliberately corrupts histogram state.

Affected systems

HdrHistogram versions up to and including 2.2.2 are affected. The vulnerability requires local access to the system or application process, making it primarily relevant to environments where untrusted local users have shell access or where application-level input is directly influenced by unprivileged actors. Java applications that embed HdrHistogram for performance monitoring or latency tracking should verify their installed version and assess local access controls.

Exploitability

Exploitation requires local access (local account or local code execution within the application), making opportunistic remote attacks impossible. The CVSS 3.1 vector (AV:L/AC:L/PR:L) confirms that a local user with minimal privileges can trigger the flaw without user interaction. While exploit code has been disclosed publicly, the practical risk remains low because the attacker must already have achieved local presence on the target system. The security community has raised questions about whether this vulnerability genuinely violates a trust boundary, particularly in single-tenant or containerized environments where local users are typically trusted or isolated.

Remediation

Upgrade HdrHistogram to a version newer than 2.2.2 that includes the range-check fix; verify the exact patched version against the vendor's official release notes. If immediate patching is not feasible, restrict local access to systems running applications that depend on HdrHistogram, and implement input validation at the application layer before passing values to the histogram recorder. Monitor for unexpected or anomalous histogram data patterns that might indicate an integrity attack.

Patch guidance

Check the official HdrHistogram repository (https://github.com/HdrHistogram/HdrHistogram) or Maven Central for releases newer than 2.2.2. Update your project's dependency declaration to reference the patched version and rebuild your application. For organizations using HdrHistogram as a transitive dependency, verify that all direct dependencies on HdrHistogram are brought to a safe version. Test the updated version in a non-production environment to confirm that application behavior remains consistent.

Detection guidance

Monitor application logs and metrics for unexpected values recorded in histograms that fall outside normal operational bounds. If your application uses HdrHistogram for latency tracking, watch for sudden percentile spikes or anomalies that correlate with periods when untrusted local users had access to the system. Code review of application input handling for histogram value sources can help identify whether attacker-controlled data reaches the recordValue() method. Consider enabling Java security manager policies to restrict which code can interact with sensitive histogram data.

Why prioritize this

CVE-2026-14686 is a low-severity vulnerability with limited exploitability due to strict local access requirements and disputed security impact. It should not take priority over critical or high-risk vulnerabilities affecting your infrastructure. However, organizations with high-assurance requirements for monitoring data integrity or those operating in multi-tenant environments with untrusted local users should address it as part of routine dependency updates. Prioritization should focus on applications where HdrHistogram is central to security-relevant decision-making.

Risk score, explained

The CVSS 3.1 score of 3.3 (Low) reflects the combination of local-only attack vector, low privilege requirement, and integrity-only impact. No confidentiality or availability impact is possible. The disputed nature of the vulnerability (whether it truly crosses a security boundary) and the high barrier to exploitation further support the low rating. Organizations should not delay critical security work to patch this issue, but should include it in the next planned dependency update cycle.

Frequently asked questions