CVE-2026-122096

Uncontrolled Resource Consumption vulnerability in the sketch deserialization of Apache DataSketches Java. Several deserializers trusted sizes and counts declared in the serialized input. A small crafted input could make an application allocate an excessive amount of memory, leading to an OutOfMemoryError. A crafted string passed to FrequentLongsSketch.getInstance(String) could also make deserialization, or a later update, loop indefinitely. Only applications that deserialize sketches from untrusted sources are affected. This issue affects Apache DataSketches Java: through 9.0.0. Users are recommended to upgrade to version 9.1.0, which fixes the issue.

• CWE-400
• CWE-789
• CWE-835

• https://github.com/apache/datasketches-java/pull/777
• https://github.com/apache/datasketches-java/pull/783
• https://github.com/apache/datasketches-java/releases/tag/9.1.0
• https://lists.apache.org/thread/9wd7ngmho7hm8x74sq1p2fp1xgjd8kt6
• https://www.openwall.com/lists/oss-security/2026/11/10/29

Published

Nov 11, 2026

Last Modified

Nov 12, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12207A security flaw has been discovered in medkey-org medkey up …4.3
• CVE-2026-12208A weakness has been identified in jsonata-js jsonata up to 2…5.5
• CVE-2026-122085The Event Tickets Manager for WooCommerce WordPress plugin b…6.5
• CVE-2026-122087The Event Tickets and Registration WordPress plugin before 5…3.7
• CVE-2026-12209A security vulnerability has been detected in RubyLouvre ava…5.5
• CVE-2026-122095AsiaInfo BSS Platform 9.2 before 9.2.38 has a stored cross-s…7.6
• CVE-2026-122097CAI Content Credentials is affected by an Uncontrolled Resou…6.5
• CVE-2026-122098CAI Content Credentials is affected by an Improper Certifica…5.1
• CVE-2026-122099CAI Content Credentials is affected by an Incorrect Authoriz…2.9
• CVE-2026-1221PrismX MX100 AP controller developed by BROWAN COMMUNICATION…9.8
• CVE-2026-12210A vulnerability was detected in universal-tool-calling-proto…6.3
• CVE-2026-122100CAI Content Credentials is affected by an Improper Verificat…5.5