External risk intelligence

Apache DataSketches C++ HLL Heap Buffer Overflow

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-103501

Apache DataSketches is a software library integrated into applications for data processing, not a standalone network service or appliance. While it can process data from various sources, it is typically used as a dependency within backend systems or internal data pipelines. Direct, public internet exposure of the deserialization function in this library is uncommon in standard deployment patterns.

Buffer Overflow

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in the Apache DataSketches C++ library that could allow an attacker to corrupt memory by sending specially crafted data for processing. While the library is designed for data processing and typically not directly exposed to external networks, applications that deserialize data from untrusted sources may be at risk. The main concern is confirming if your applications utilize this library in a way that deserializes external data.

Memory corruption risk from untrusted data.
Confirms if your data processing is exposed.
Verify untrusted data processing in your applications.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted sketch to an application that processes data sketches. The application, when deserializing this sketch, would incorrectly handle the coupon count, leading to a heap buffer overflow. This overflow could corrupt memory, potentially allowing the attacker to crash the application or gain further control.

Attacker sends malicious sketch.
Application deserializes sketch data.
Heap corruption, crash, or exploitation.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could impact applications that deserialize HLL sketches from untrusted sources. When processing these untrusted sketches, a heap buffer overflow could occur, potentially leading to memory corruption, application crashes, and the possibility of further exploitation. This risk is present when the affected library is used in applications that accept and deserialize sketch data from external or unverified inputs.

Affected data processing within applications.
Deserializing crafted HLL sketches from untrusted sources.
Application crashes or potential further exploitation.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical heap buffer overflow in Apache DataSketches C++ affects applications deserializing HLL sketches from untrusted sources. Identifying where this library is used and whether the deserialization is exposed to untrusted input is the crucial first step. Application owners or platform teams are likely responsible for remediation, which may involve vendor coordination or upgrading the library.

Application owners should confirm usage.
Verify untrusted sketch deserialization exposure.
Plan library upgrade or mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Apache DataSketches C++?

Apache DataSketches C++ is a specialized software library designed for high-performance approximate computation. Developers integrate it into their backend systems, databases, or data processing pipelines to analyze massive datasets efficiently using compact, probabilistic structures called sketches, rather than storing every individual data point.

How does CVE-2026-103501 cause a heap buffer overflow?

This vulnerability, classified as CWE-122 (Heap-based Buffer Overflow), occurs when the library processes 'LIST' mode HLL sketches. The software fails to validate the number of entries provided in the input against the capacity of a fixed-size internal buffer. By crafting a specific sketch, an attacker can force the system to write data beyond that buffer's memory boundary, potentially corrupting adjacent heap memory.

What triggers this heap corruption?

The issue is triggered specifically when the library deserializes HLL sketches from a byte buffer or stream. Crucially, the vulnerability does not manifest if your application only deserializes trusted, internally generated data. Only applications that accept and process sketches sourced from unverified or untrusted external inputs are vulnerable to this memory corruption.

Is my application at risk from this vulnerability?

According to Halo Surface Signal, risk is generally unlikely because this library is typically an internal backend dependency, not a public-facing service. You should prioritize assessment if your software specifically deserializes sketch data coming from the internet or other untrusted sources, rather than relying on its internal, private use within your data pipelines.

How do I address CVE-2026-103501?

Your first step is to perform a dependency audit to confirm if your software includes the affected versions of the Apache DataSketches C++ library. If you identify usage, evaluate whether those modules deserialize data from untrusted sources. If so, plan to upgrade to version 5.3.0, which includes the necessary security checks to prevent this buffer overflow.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.