t-digest vulnerabilities

2 known vulnerabilities in t-digest from Tdunning. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  t-digest: Improper Validation of Specified Quantity in Input

  CVE-2026-87962Sep 10, 2026Tdunning

  t-digest versions 3.1 through 3.3 contain a denial of service vulnerability in MergingDigest.fromBytes that fails to validate length and capacity fields from serialized data. Attackers can supply crafted serialized digests with mismatched header fields to trig

• 7.5 High severity

  t-digest: Inefficient Algorithmic Complexity

  CVE-2026-87822Sep 9, 2026Tdunning

  t-digest versions 3.1 through 3.3 fail to validate centroid means during deserialization in MergingDigest.fromBytes, allowing attackers to inject NaN values that bypass validation checks. Attackers can craft malicious serialized digests containing NaN centroid