Apache DataSketches C++: Out-of-bounds read and write in CPC sketch deserialization
Summary
Apache DataSketches C++ (datasketches-cpp) contains out-of-bounds read and write flaws in the deserialization of CPC sketches. A crafted serialized sketch passed to cpc_sketch::deserialize() can read past the end of the input and, in the hybrid flavor, write outside an internal heap buffer, which can corrupt heap memory. Successful exploitation can crash the application and may enable further attacks. Only applications that deserialize CPC sketches from untrusted sources are affected.
Affected
- Apache DataSketches C++ from 2.0.0-incubating before 5.3.0
- Versions up to 5.2.x are considered affected; the exact last affected release is not confirmed by the vendor beyond the 'before 5.3.0' range
- Downstream packages and bindings (for example PostgreSQL extensions): fixed-version status unknown
Fixed in
- Apache DataSketches C++ 5.3.0
Workaround
- No vendor workaround listed.
- Do not deserialize CPC sketches from untrusted or unauthenticated input until patched.
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- Not listed in CISA KEV.
- No public proof of concept found; no reports of exploitation in the wild found.
Our recommendation
- Inventory where datasketches-cpp or related extensions are used, including vendored copies.
- Upgrade to 5.3.0 where you control the build; for extensions, check whether a release bundling 5.3.0 is available.
- Restrict who can supply sketch data and isolate deserialization, for example in a separate worker process, so a crash does not take down a database server.
- Recheck NVD for updated scoring before filing.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache DataSketches 5.3.0 release notes github.com
- Apache mailing list thread lists.apache.org
- OSS-Security mailing list www.openwall.com
- OSV record CVE-2026-103513 osv.dev
- OpenCVE CVE-2026-103513 app.opencve.io
- datasketches-postgresql pull request 80 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 19:45.
Original description (NVD)
Out-of-bounds read and write in the CPC sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). A crafted serialized CPC sketch passed to cpc_sketch::deserialize(), from either a byte buffer or a stream, can cause the decompressor to read past the end of the compressed data, because the read position was only checked after decoding finished. In the hybrid flavor, it can also cause a write outside an internal heap buffer, because decoded row indices were not validated. Several other header fields and decoded values, including lg_k, were also not validated. This can corrupt heap memory, causing a crash and potentially enabling further exploitation. This issue affects Apache DataSketches C++: from 2.0.0-incubating before 5.3.0. Only applications that deserialize CPC sketches from untrusted sources are affected. Users are recommended to upgrade to version 5.3.0, which fixes this issue.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.