com.tdunning:t-digest 3.3

Direct Vulnerabilities

Known vulnerabilities in the com.tdunning:t-digest package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Improper Validation of Specified Quantity in Input Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input due to unvalidated length and capacity fields in `MergingDigest.fromBytes` in `core/src/main/java/com/tdunning/math/stats/MergingDigest.java`. An attacker can abort the parsing thread by supplying crafted serialized digests with mismatched header values that trigger `ArrayIndexOutOfBoundsException` or `NegativeArraySizeException`. When an application deserializes untrusted digest data with an affected t-digest, the malformed input causes the reader to fail before completing the parse. This can disrupt services that accept or exchange serialized digests, leaving requests unprocessed and the component handling the data unavailable. How to fix Improper Validation of Specified Quantity in Input? There is no fixed version for `com.tdunning:t-digest`.	[3.1,)
H Inefficient Algorithmic Complexity Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity through `MergingDigest.fromBytes` in `core/src/main/java/com/tdunning/math/stats/MergingDigest.java`. An attacker can trigger severe processing delays by supplying a crafted serialized digest containing `NaN` centroid means during deserialization. The invalid centroid values bypass validation and cause merge-related sorting to degrade from `O(n log n)` to `O(n^2)`, slowing or stalling applications that ingest untrusted t-digest data. How to fix Inefficient Algorithmic Complexity? There is no fixed version for `com.tdunning:t-digest`.	[3.1,)

Vulnerability

Vulnerable Version

Improper Validation of Specified Quantity in Input

Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input due to unvalidated length and capacity fields in MergingDigest.fromBytes in core/src/main/java/com/tdunning/math/stats/MergingDigest.java. An attacker can abort the parsing thread by supplying crafted serialized digests with mismatched header values that trigger ArrayIndexOutOfBoundsException or NegativeArraySizeException. When an application deserializes untrusted digest data with an affected t-digest, the malformed input causes the reader to fail before completing the parse. This can disrupt services that accept or exchange serialized digests, leaving requests unprocessed and the component handling the data unavailable.

How to fix Improper Validation of Specified Quantity in Input?

There is no fixed version for com.tdunning:t-digest.

[3.1,)

Inefficient Algorithmic Complexity

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity through MergingDigest.fromBytes in core/src/main/java/com/tdunning/math/stats/MergingDigest.java. An attacker can trigger severe processing delays by supplying a crafted serialized digest containing NaN centroid means during deserialization. The invalid centroid values bypass validation and cause merge-related sorting to degrade from O(n log n) to O(n^2), slowing or stalling applications that ingest untrusted t-digest data.

How to fix Inefficient Algorithmic Complexity?

There is no fixed version for com.tdunning:t-digest.

[3.1,)

com.tdunning:t-digest@3.3

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically