Skip to content
VulniPulse
Sign in
Advisory severityUnratedApache Software Foundation Updated

Advisory [CVE-2026-103635] Out-of-bounds read in the compact Theta sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp)

This security Apache Software Foundation advisory covers CVE-2026-103635 affecting Apache DataSketches.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2026-103635 Source published Source updated

VulniPulse record published Record updated

CVE-2026-103635
Affected products & platforms
Apache Software FoundationUnclassified
Open source advisory

Android app · Google Play

Monitor future Apache Software Foundation CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features

Summary

Out-of-bounds read in the compact Theta sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp).

compact_theta_sketch::deserialize() and wrapped_compact_theta_sketch::wrap() read header fields before checking that the input was long enough. For the compressed format, the size check could be defeated by a 32-bit overflow, and two header fields that control decoding were not validated; this also affected deserialization from a stream.

A crafted or truncated sketch could cause a read past the end of the input. In the compressed case the over-read can be large, and the bytes read can become part of the deserialized sketch.

This can cause a crash (denial of service) and could expose adjacent memory contents.

This issue affects Apache DataSketches C++: from 3.1.0 before 5.3.0. Only applications that deserialize Theta sketches from untrusted sources are affected.

Users are recommended to upgrade to version 5.3.0, which fixes this issue.

Affected versions
  • 3.1.0 before 5.3.0

Official advisory · medium-confidence parse· fetched 16 hours ago·verify at source

Fixed versions
  • 5.3.0

Official advisory · medium-confidence parse· fetched 16 hours ago·verify at source

Mitigation checklist

Recommended fix / mitigation
  • Users are recommended to upgrade to version 5.3.0, which fixes this issue.

Official advisory · medium-confidence parse· fetched 16 hours ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.