CVE-2026-14686
HdrHistogram Range Check DoubleHistogram.java org.HdrHistogram.DoubleHistogram.recordValue comparison
A vulnerability was found in HdrHistogram up to 2.2.2. This issue affects the function org.HdrHistogram.DoubleHistogram.recordValue of the file src/main/java/org/HdrHistogram/DoubleHistogram.java of the component Range Check. Performing a manipulation results in incorrect comparison. The attack is only possible with local access. The exploit has been made public and could be used. The presence of this vulnerability remains uncertain at this time. This issue is disputed due to the potential lack of crossing of security boundaries and the pre-requisites for a successful attack.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
HdrHistogram Range Check DoubleHistogram.java org.HdrHistogram.DoubleHistogram.recordValue comparison
A vulnerability was found in HdrHistogram up to 2.2.2. This issue affects the function org.HdrHistogram.DoubleHistogram.recordValue of the file src/main/java/org/HdrHistogram/DoubleHistogram.java of the component Range Check. Performing a manipulation results in incorrect comparison. The attack is only possible with local access. The exploit has been made public and could be used. The presence of this vulnerability remains uncertain at this time. This issue is disputed due to the potential lack of crossing of security boundaries and the pre-requisites for a successful attack.
- Record
CVE-2026-14686- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R - CVSS 3.0
- 3.3 Low
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R - CVSS 2.0
- 1.7
AV:L/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR - Weakness
- CWE-697
- Updated
- 2026-11-02
EUVDEUVD-2026-41708
A vulnerability was found in HdrHistogram up to 2.2.2. This issue affects the function org.HdrHistogram.DoubleHistogram.recordValue of the file src/main/java/org/HdrHistogram/DoubleHistogram.java of the component Range Check. Performing a manipulation results in incorrect comparison. The attack is only possible with local access. The exploit has been made public and could be used. The presence of this vulnerability remains uncertain at this time. This issue is disputed due to the potential lack of crossing of security boundaries and the pre-requisites for a successful attack.
- Record
EUVD-2026-41708- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-pcmr-4mmx-225x
A vulnerability was found in HdrHistogram up to 2.2.2. This issue affects the function org...
A vulnerability was found in HdrHistogram up to 2.2.2. This issue affects the function org.HdrHistogram.DoubleHistogram.recordValue of the file src/main/java/org/HdrHistogram/DoubleHistogram.java of the component Range Check. Performing a manipulation results in incorrect comparison. The attack is only possible with local access. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
- Record
GHSA-pcmr-4mmx-225x- CVSS 4.0
- 1.9 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-697
- Updated
- 2026-11-02
NVD
A vulnerability was found in HdrHistogram up to 2.2.2. This issue affects the function org.HdrHistogram.DoubleHistogram.recordValue of the file src/main/java/org/HdrHistogram/DoubleHistogram.java of the component Range Check. Performing a manipulation results in incorrect comparison. The attack is only possible with local access. The exploit has been made public and could be used. The presence of this vulnerability remains uncertain at this time. This issue is disputed due to the potential lack of crossing of security boundaries and the pre-requisites for a successful attack.
- Record
CVE-2026-14686- CVSS 4.0
- 1.9 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - CVSS 2.0
- 1.7 Low
AV:L/AC:L/Au:S/C:N/I:P/A:N - Weakness
- CWE-697
- Updated
- 2026-11-02
OSV
HdrHistogram Range Check DoubleHistogram.java org.HdrHistogram.DoubleHistogram.recordValue comparison
A vulnerability was found in HdrHistogram up to 2.2.2. This issue affects the function org.HdrHistogram.DoubleHistogram.recordValue of the file src/main/java/org/HdrHistogram/DoubleHistogram.java of the component Range Check. Performing a manipulation results in incorrect comparison. The attack is only possible with local access. The exploit has been made public and could be used. The presence of this vulnerability remains uncertain at this time. This issue is disputed due to the potential lack of crossing of security boundaries and the pre-requisites for a successful attack.
- Record
CVE-2026-14686- CVSS 4.0
- 1.9 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P - Weakness
- CWE-697
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-14686
A vulnerability was found in HdrHistogram up to 2.2.2. This issue affects the function org.HdrHistogram.DoubleHistogram.recordValue of the file src/main/java/org/HdrHistogram/DoubleHistogram.java of the component Range Check. Performing a manipulation results in incorrect comparison. The attack is only possible with local access. The exploit has been made public and could be used. The presence of this vulnerability remains uncertain at this time. This issue is disputed due to the potential lack of crossing of security boundaries and the pre-requisites for a successful attack.
- Record
DEBIAN-CVE-2026-14686- CVSS 4.0
- 1.9 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVRHSA-2026:26989
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:26989- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:34975
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:34975- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-14686
A vulnerability was found in HdrHistogram up to 2.2.2. This issue affects the function org.HdrHistogram.DoubleHistogram.recordValue of the file src/main/java/org/HdrHistogram/DoubleHistogram.java of the component Range Check. Performing a manipulation results in incorrect comparison. The attack is only possible with local access. The exploit has been made public and could be used. The presence of this vulnerability remains uncertain at this time. This issue is disputed due to the potential lack of crossing of security boundaries and the pre-requisites for a successful attack.
- Record
UBUNTU-CVE-2026-14686- CVSS 4.0
- 1.9 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
hdrhistogramDebian:12 |
All versions, plus listed versions 2.1.11-12.2.2-1 |
None known |
hdrhistogramDebian:13 |
All versions, plus listed versions 2.1.11-12.2.2-1 |
None known |
hdrhistogramDebian:14 |
before 2.2.2-1, plus listed versions 2.1.11-1 |
2.2.2-1 |
netavarkRed Hat:hummingbird:1 From an advisory covering 4 CVEs |
before 0:2.0.0-1.hum1 | 0:2.0.0-1.hum1 |
netavark-testsRed Hat:hummingbird:1 From an advisory covering 4 CVEs |
before 0:2.0.0-1.hum1 | 0:2.0.0-1.hum1 |
cargoRed Hat:hummingbird:1 From an advisory covering 24 CVEs |
before 0:1.96.1-1.hum1 | 0:1.96.1-1.hum1 |
clippyRed Hat:hummingbird:1 From an advisory covering 24 CVEs |
before 0:1.96.1-1.hum1 | 0:1.96.1-1.hum1 |
rustRed Hat:hummingbird:1 From an advisory covering 24 CVEs |
before 0:1.96.1-1.hum1 | 0:1.96.1-1.hum1 |
rust-analyzerRed Hat:hummingbird:1 From an advisory covering 24 CVEs |
before 0:1.96.1-1.hum1 | 0:1.96.1-1.hum1 |
rust-debugger-commonRed Hat:hummingbird:1 From an advisory covering 24 CVEs |
before 0:1.96.1-1.hum1 | 0:1.96.1-1.hum1 |
Show 21 moreShow less
| Package | Affected | Fixed |
|---|---|---|
rust-docRed Hat:hummingbird:1 From an advisory covering 24 CVEs |
before 0:1.96.1-1.hum1 | 0:1.96.1-1.hum1 |
rust-gdbRed Hat:hummingbird:1 From an advisory covering 24 CVEs |
before 0:1.96.1-1.hum1 | 0:1.96.1-1.hum1 |
rust-lldbRed Hat:hummingbird:1 From an advisory covering 24 CVEs |
before 0:1.96.1-1.hum1 | 0:1.96.1-1.hum1 |
rust-srcRed Hat:hummingbird:1 From an advisory covering 24 CVEs |
before 0:1.96.1-1.hum1 | 0:1.96.1-1.hum1 |
rust-std-staticRed Hat:hummingbird:1 From an advisory covering 24 CVEs |
before 0:1.96.1-1.hum1 | 0:1.96.1-1.hum1 |
rust-std-static-aarch64-unknown-none-softfloatRed Hat:hummingbird:1 From an advisory covering 24 CVEs |
before 0:1.96.1-1.hum1 | 0:1.96.1-1.hum1 |
rust-std-static-aarch64-unknown-uefiRed Hat:hummingbird:1 From an advisory covering 24 CVEs |
before 0:1.96.1-1.hum1 | 0:1.96.1-1.hum1 |
rust-std-static-i686-pc-windows-gnuRed Hat:hummingbird:1 From an advisory covering 24 CVEs |
before 0:1.96.1-1.hum1 | 0:1.96.1-1.hum1 |
rust-std-static-wasm32-unknown-unknownRed Hat:hummingbird:1 From an advisory covering 24 CVEs |
before 0:1.96.1-1.hum1 | 0:1.96.1-1.hum1 |
rust-std-static-wasm32-wasip1Red Hat:hummingbird:1 From an advisory covering 24 CVEs |
before 0:1.96.1-1.hum1 | 0:1.96.1-1.hum1 |
rust-std-static-x86_64-pc-windows-gnuRed Hat:hummingbird:1 From an advisory covering 24 CVEs |
before 0:1.96.1-1.hum1 | 0:1.96.1-1.hum1 |
rust-std-static-x86_64-unknown-noneRed Hat:hummingbird:1 From an advisory covering 24 CVEs |
before 0:1.96.1-1.hum1 | 0:1.96.1-1.hum1 |
rust-std-static-x86_64-unknown-uefiRed Hat:hummingbird:1 From an advisory covering 24 CVEs |
before 0:1.96.1-1.hum1 | 0:1.96.1-1.hum1 |
rustfmtRed Hat:hummingbird:1 From an advisory covering 24 CVEs |
before 0:1.96.1-1.hum1 | 0:1.96.1-1.hum1 |
hdrhistogramUbuntu:18.04:LTS |
All versions, plus listed versions 2.1.10-1 |
None known |
hdrhistogramUbuntu:20.04:LTS |
All versions, plus listed versions 2.1.11-1 |
None known |
hdrhistogramUbuntu:22.04:LTS |
All versions, plus listed versions 2.1.11-1 |
None known |
hdrhistogramUbuntu:24.04:LTS |
All versions, plus listed versions 2.1.11-1 |
None known |
hdrhistogramUbuntu:25.10 |
All versions, plus listed versions 2.1.11-1 |
None known |
hdrhistogramUbuntu:26.10 |
All versions, plus listed versions 2.1.11-1build12.2.2-1 |
None known |
hdrhistogramUbuntu:26.04:LTS |
All versions, plus listed versions 2.1.11-12.1.11-1build1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-14686 is a medium vulnerability (CVSS 4.8) in hdrhistogram, published July 4, 2026. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 25th percentile. Fixed in hdrhistogram 2.2.2-1.
References
vuldb.com/vuln/376282
github.com/HdrHistogram/HdrHistogram/issues/222
Show 180 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-14686
security-tracker.debian.org/tracker/CVE-2026-14686
access.redhat.com/errata/RHSA-2026:26989
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_26989.json
bugzilla.redhat.com/show_bug.cgi?id=2497102
cve.org/CVERecord?id=CVE-2026-14683
curl.se/docs/CVE-2026-8286.html
hackerone.com/reports/3718195
ubuntu.com/security/CVE-2026-14686