CVE-2026-87822: Deserialization Vulnerability in t-digest

CVE-2026-87822 is a critical vulnerability within the t-digest library, specifically affecting the MergingDigest.fromBytes deserialization method in versions 3.1 through 3.3. The vulnerability stems from a failure to validate centroid mean values during the deserialization process. An attacker can supply a specially crafted serialized digest containing Not-a-Number (NaN) values. When the library attempts to merge these malformed digests, the presence of NaN values disrupts the standard sorting logic. This degradation shifts the computational complexity of the merge operation from O(n log n) to O(n squared). Defenders should note that this vulnerability primarily enables a denial-of-service (DoS) condition by inducing severe processing delays or exhaustion of CPU resources in applications that rely on untrusted input for digest deserialization.

Impact

Successful exploitation results in a denial-of-service condition due to computational complexity amplification. Organizations utilizing t-digest for high-throughput stream processing or large-scale data aggregation are at the highest risk, as the performance degradation could stall critical data pipelines and consume excessive compute resources, leading to potential service outages in systems that process serialized digest inputs from external or untrusted sources.

Recommendation

Prioritized actions for engineering teams:

• Identify all applications within the environment that import t-digest versions 3.1 through 3.3.
• Update t-digest dependencies to a version where this validation logic has been addressed.
• Implement input validation at the application boundary to inspect serialized data before passing it to the MergingDigest.fromBytes method.
• Monitor for unusual CPU spikes in services handling serialized t-digest objects, which may indicate attempted exploitation.