Denial of Service in t-digest via Malformed Serialized Data

Executive Summary

This vulnerability affects t-digest versions 3.1 through 3.3. It involves a denial of service flaw in the MergingDigest.fromBytes method where serialized data is not properly validated. Attackers can craft malicious serialized digests with mismatched header fields, causing ArrayIndexOutOfBoundsException or NegativeArraySizeException, which crashes the parsing thread.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect applications using t-digest versions 3.1 through 3.3 for crashes during deserialization of crafted byte arrays. Monitor logs for ArrayIndexOutOfBoundsException or NegativeArraySizeException in threads handling MergingDigest.fromBytes. Check if serialized data from untrusted sources is processed without validation.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause denial of service by crashing threads processing serialized digests. Systems using t-digest for quantile calculations or statistical aggregations may experience unexpected failures or downtime when malicious input is processed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability is a denial-of-service issue that crashes parsing threads via crafted serialized data. It does not directly affect data confidentiality or integrity but could disrupt services processing statistical data, potentially impacting compliance with availability requirements in standards like GDPR (Article 32) or HIPAA (Security Rule).

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade t-digest to a patched version beyond 3.3. If upgrading is not possible, validate all serialized data length fields before passing to MergingDigest.fromBytes. Ensure no untrusted byte arrays are deserialized without bounds checking.

Useful 0 Not Useful 0