Skip to content
VulniPulse
Sign inStart free
MediumApache Software Foundation Updated

CVE-2026-123274: Out-of-bounds Write vulnerability in Apache DataSketches C++

This Apache advisory covers CVE-2026-123274 in Apache DataSketches.

Open the Apache advisory

Key facts

Vendor rating
Medium
Weakness
  • CWE-787, Out-of-bounds Write
CISA KEV
Not listed (catalogue checked )
Affected
through 5.3.0
Fixed in
5.3.1
Source published
Source revised
Listed by VulniPulse

Compiled by VulniPulse from the linked sources. How records are collected and checked.

Affected products & platforms

Apache Software FoundationApache DataSketches

Description

Out-of-bounds Write vulnerability in Apache DataSketches C++. An

application that deserializes a KLL sketch from an untrusted source can have heap memory corrupted by a crafted sketch, because the

serialized level boundaries were not validated.

This issue affects Apache DataSketches C++: 2.0.0 through 5.3.0.

Users are recommended to upgrade to version 5.3.1, which fixes the

Text from the source record.

Affected versions
  • through 5.3.0

Official advisory · high-confidence parse· fetched ·verify at source

How to fix CVE-2026-123274

Upgrade to a fixed release named by Apache:

  • 5.3.1

Vendor guidance

  • Users are recommended to upgrade to version 5.3.1, which fixes the issue.

More Apache Software Foundation advisories

Apache Software Foundation advisories, November 2026All Apache Software Foundation advisories

Get an email when Apache publishes the next one.

See Apache's last 90 days first. Live alerts for one product are free for life; every vendor is US$15 a month after a free month.

Alert me about Apache