Vulnerability feed

Executive summary

The advisory says that Apache DataSketches C++ has an out-of-bounds read and write flaw in Count-Min sketch deserialization, affecting versions 4.1.0 through 5.2.0. It is rated moderate, and the vendor recommends upgrading to 5.3.0, which the release notes say affects only applications that deserialize sketches from untrusted sources.

Technical summary

The flaw is an out-of-bounds read and write in count_min_sketch::deserialize(), which did not validate header fields and sizes before use. The advisory states it affects 4.1.0 through 5.2.0 and is fixed in 5.3.0, where header fields and sizes are now validated before use for Count-Min deserialization (#538). The release notes say it only affects applications that deserialize sketches from untrusted sources, so exposure depends on feeding untrusted input to the deserializer. Workarounds are not stated, and no exploitation in the wild, CVSS score, or detection guidance is stated in the advisory.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/apache/datasketches-cpp/releases/tag/5.3.0

Score

No CVSS score published.

Affects

ApacheApache DataSketchesApache DataSketches C++