Medium [CVE-2026-103634] Out-of-bounds read and write in the Count-Min sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp)
This medium-severity Apache Software Foundation advisory covers CVE-2026-103634 affecting Apache DataSketches.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Get an email when Apache Software Foundation publishes the next one.
VulniPulse checks Apache Software Foundation's security advisories around the clock and emails you new ones with the severity, the fixed version and the vendor's link. First month free, then US$15/month; we email you before the first charge.
Summary
Out-of-bounds read and write in the Count-Min sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp).
count_min_sketch::deserialize() did not include the preamble in its input size check, so a truncated sketch could cause a read of up to 16 bytes past the end of the input. In addition, the table size was computed from the serialized number of buckets and number of hash functions in 32-bit arithmetic.
A crafted sketch could make it wrap to zero, so that the sketch deserialized with an empty table, and later updates and estimate queries read and wrote outside the heap allocation. This can corrupt heap memory, causing a crash and potentially enabling further exploitation.
This issue affects Apache DataSketches C++: from 4.1.0 before 5.3.0. Only applications that deserialize Count-Min sketches from untrusted sources are affected.
Users are recommended to upgrade to version 5.3.0, which fixes this issue.
- 4.1.0 before 5.3.0
Official advisory · high-confidence parse· fetched 6 days ago·verify at source
Mitigation checklist
- Users are recommended to upgrade to version 5.3.0, which fixes this issue.
Official advisory · high-confidence parse· fetched 6 days ago·verify at source
More Apache Software Foundation advisories
- CVE-2026-103636Oct 10, 2026Out-of-bounds read in the VarOpt union deserialization of Apache DataSketches C++
- CVE-2026-103635Oct 10, 2026Out-of-bounds read in the compact Theta sketch deserialization of Apache DataSketches C++
- CVE-2026-103513Oct 10, 2026Out-of-bounds read and write in the CPC sketch deserialization of Apache DataSketches C++
- CVE-2026-103501Oct 10, 2026Heap buffer overflow in the HLL sketch deserialization of Apache DataSketches C++
- CVE-2026-111422Oct 26, 2026Apache Airflow SSH provider command injection
- CVE-2026-115748Oct 26, 2026**UNSUPPORTED WHEN ASSIGNED** Authorization bypass in Apache Vysper, all versions
Android app · Google Play
Monitor future Apache Software Foundation CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.