CVE-2026-82596
Received Received - Intake

Memory Corruption in LatencyUtils PauseDetector

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: VulDB

Description
A vulnerability was determined in LatencyUtils up to 2.0.3. Affected by this issue is the function LatencyStats.recordDetectedPause of the file src/main/java/org/LatencyUtils/LatencyStats.java of the component PauseDetector. Executing a manipulation can lead to memory corruption. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-82596
EUVD
EUVD-2026-68299

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
latencyutils latencyutils to 2.0.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-82596 is a denial-of-service vulnerability in LatencyUtils versions 2.0.3 and earlier. It occurs when a detected execution pause exceeds the configured highestTrackableLatency threshold, causing an uncaught ArrayIndexOutOfBoundsException in the PauseDetector dispatch thread. This thread only handles InterruptedException, so the exception crashes the thread permanently. Since the PauseDetector is a process-wide static singleton with an unbounded message queue, its death leads to unbounded memory growth and eventual OutOfMemoryError. It also permanently disables pause correction for all LatencyStats instances in the JVM.

Detection Guidance

Check if LatencyUtils versions 2.0.3 or earlier are installed by running commands like 'find / -name LatencyStats.java 2>/dev/null' or 'mvn dependency:tree | grep LatencyUtils'. Monitor for high memory usage or OutOfMemoryError in JVM processes using tools like 'jstat -gc <pid>' or 'top -p <pid>'. Look for PauseDetector thread crashes in logs with 'jstack <pid> | grep -i PauseDetector'.

Impact Analysis

This vulnerability can cause system crashes due to OutOfMemoryError from unbounded memory growth. It permanently disables pause correction for latency measurements, leading to inaccurate performance data. Routine events like garbage collection pauses or system sleep may trigger the issue. In severe cases, it could disrupt applications relying on accurate latency tracking, causing performance degradation or service outages.

Mitigation Strategies

Upgrade LatencyUtils to a version beyond 2.0.3 if available. If upgrading is not possible, disable the PauseDetector feature in LatencyStats configurations or restrict JVM access to untrusted users. Monitor JVM memory usage closely and restart affected services if thread crashes occur.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82596. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart