Cpe:2.3:a:t-Digest_project:t-Digest:3.3:*:*:*:*:*:*:*

The MergingDigest.fromBytes method in t-digest versions 3.1 through 3.3 fails to validate centroid means during deserialization, allowing attackers to inject NaN values that trigger a denial-of-service via algorithmic complexity degradation.