CVE-2026-123338
Apache DataSketches C++: Out-of-bounds write in REQ sketch deserialization allows memory corruption via a crafted sketch
CVE-2026-123338 is a vulnerability with no CVSS score yet in Apache Software Foundation Datasketches C++, published November 13, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.23%, the 13th percentile. No source names a fixed version.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- 0.23%EPSS, 13th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
Out-of-bounds Write vulnerability in Apache DataSketches C++. An application that deserializes a REQ sketch from an untrusted source can have heap memory corrupted by a crafted sketch, because the serialized compactor headers were not validated.
This issue affects Apache DataSketches C++: from 3.0.0 through 5.3.0.
Users are recommended to upgrade to version 5.3.1, which fixes the issue.
Exploit likelihood
Affected products
What each source reports
CVE ListNo score
Apache DataSketches C++: Out-of-bounds write in REQ sketch deserialization allows memory corruption via a crafted sketch
Out-of-bounds Write vulnerability in Apache DataSketches C++. An application that deserializes a REQ sketch from an untrusted source can have heap memory corrupted by a crafted sketch, because the serialized compactor headers were not validated.
This issue affects Apache DataSketches C++: from 3.0.0 through 5.3.0.
Users are recommended to upgrade to version 5.3.1, which fixes the issue.
- Record
CVE-2026-123338- Weakness
- CWE-787
- Updated
- 2026-11-13
EUVDEUVD-2026-125274No score
Out-of-bounds Write vulnerability in Apache DataSketches C++. An application that deserializes a REQ sketch from an untrusted source can have heap memory corrupted by a crafted sketch, because the serialized compactor headers were not validated.
This issue affects Apache DataSketches C++: from 3.0.0 through 5.3.0.
Users are recommended to upgrade to version 5.3.1, which fixes the issue.
- Record
EUVD-2026-125274- Updated
- 2026-11-13
GitHub AdvisoriesGHSA-f29r-h9w7-gp62No score
Out-of-bounds Write vulnerability in Apache DataSketches C++. An application that deserializes...
Out-of-bounds Write vulnerability in Apache DataSketches C++. An application that deserializes a REQ sketch from an untrusted source can have heap memory corrupted by a crafted sketch, because the serialized compactor headers were not validated.
This issue affects Apache DataSketches C++: from 3.0.0 through 5.3.0.
Users are recommended to upgrade to version 5.3.1, which fixes the issue.
- Record
GHSA-f29r-h9w7-gp62- Weakness
- CWE-787
- Updated
- 2026-11-13
NVDNo score
Out-of-bounds Write vulnerability in Apache DataSketches C++. An application that deserializes a REQ sketch from an untrusted source can have heap memory corrupted by a crafted sketch, because the serialized compactor headers were not validated.
This issue affects Apache DataSketches C++: from 3.0.0 through 5.3.0.
Users are recommended to upgrade to version 5.3.1, which fixes the issue.
- Record
CVE-2026-123338- Weakness
- CWE-787
- Updated
- 2026-11-13
OSVNo score
Apache DataSketches C++: Out-of-bounds write in REQ sketch deserialization allows memory corruption via a crafted sketch
Out-of-bounds Write vulnerability in Apache DataSketches C++. An application that deserializes a REQ sketch from an untrusted source can have heap memory corrupted by a crafted sketch, because the serialized compactor headers were not validated.
This issue affects Apache DataSketches C++: from 3.0.0 through 5.3.0.
Users are recommended to upgrade to version 5.3.1, which fixes the issue.
- Record
CVE-2026-123338- Weakness
- CWE-787
- Updated
- 2026-11-15
History
| Recorded | Changed | Sources |
|---|---|---|
| references | OSV | |
| published | EUVD | |
| published | EUVD, NVD | |
| aliases, references | CVE List, GitHub Advisories | |
| aliases, published | EUVD | |
| first indexed | CVE List |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
lists.apache.org/thread/wjsso4wl0f0nczwh7gd74kc5wckn1635
github.com/apache/datasketches-cpp/releases/tag/5.3.1
openwall.com/lists/oss-security/2026/11/13/2
nvd.nist.gov/vuln/detail/CVE-2026-123338