CVE-2026-87822

Awaiting Analysis Awaiting Analysis - Queue

Denial of Service in t-digest via NaN Injection

Publication date: 2026-09-09

Last updated on: 2026-09-10

Assigner: VulnCheck

Description

t-digest versions 3.1 through 3.3 fail to validate centroid means during deserialization in MergingDigest.fromBytes, allowing attackers to inject NaN values that bypass validation checks. Attackers can craft malicious serialized digests containing NaN centroids that degrade sorting performance from O(n log n) to O(n squared), causing severe processing delays during merge operations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-10

Generated

2026-09-30

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-87822

EUVD

EUVD-2026-75020

Affected Vendors & Products

Vendor	Product	Version / Range
tdunning	t-digest	From 3.1 (inc) to 3.3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-407	An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

Executive Summary

CVE-2026-87822 is a high-severity vulnerability in t-digest versions 3.1 through 3.3. It allows attackers to inject NaN values during deserialization in the MergingDigest.fromBytes function. These NaN values bypass validation checks and degrade sorting performance from O(n log n) to O(n squared), causing severe processing delays during merge operations.

Detection Guidance

To detect this vulnerability, inspect your t-digest library version. If using versions 3.1 through 3.3, the system is vulnerable. Check for unusual CPU spikes during merge operations or sorting tasks, as these may indicate exploitation attempts.

Impact Analysis

This vulnerability enables denial-of-service attacks by consuming excessive CPU resources. Attackers can craft malicious serialized digests that, when merged, cause quadratic time complexity in sorting. This leads to system unresponsiveness and potential service disruptions in applications using t-digest for quantile estimation or data processing.

Compliance Impact

This vulnerability primarily causes denial-of-service through resource exhaustion by degrading sorting performance from O(n log n) to O(n squared) when processing malicious serialized digests. It does not directly lead to data breaches or unauthorized access, which are key concerns for GDPR and HIPAA compliance. However, the resulting system unavailability could impact data processing timelines required by these regulations.

Mitigation Strategies

Upgrade t-digest to a version beyond 3.3 immediately. If upgrading is not possible, implement input validation to reject NaN values during deserialization in MergingDigest.fromBytes. Monitor CPU usage for abnormal patterns during merge operations.

Hi! I’m here to help you understand CVE-2026-87822. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70