Apache DataSketches C++: Out-of-bounds read in Theta sketch deserialization
Summary
Apache DataSketches C++ reads header fields of compact Theta sketches before checking the input length, and some fields are not validated. A crafted or truncated sketch can cause a read past the end of the input, which can crash the application (denial of service) and may expose adjacent memory contents. Only applications that deserialize Theta sketches from untrusted sources are affected.
Affected
- Apache DataSketches C++ (datasketches-cpp) 3.1.0 through 5.2.0
- Affected CNA range per the CVE record: 3.1.0 to <= 5.2.0
Fixed in
- Apache DataSketches C++ 5.3.0
- Downstream packages must be checked separately, for example the PostgreSQL extension (bundled C++ 5.0.0 in 1.7.0) and the Rust binding apache-datasketches-rs (vendoring 5.2.0 at the time of research)
Workaround
Unknown. No vendor workaround is published.
- Until the library is updated, accept Theta sketches only from trusted sources.
- Run the deserializing process with minimal privileges and isolate it from sensitive data.
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- No public proof of concept or evidence of exploitation found in the research.
- The CVSS 9.1 rating reflects a worst case.
Our recommendation
- Inventory all uses of datasketches-cpp, including bindings, extensions and vendored copies.
- Upgrade to 5.3.0 or to a downstream release that bundles it, and review the serialization changes in 5.3.0 if sketches are exchanged with other languages.
- Until patched, restrict sketch input to trusted sources, especially in multi-user databases or services that accept sketch blobs from clients.
- Check the Apache advisory and NVD for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache DataSketches C++ 5.3.0 release notes github.com
- OSV entry CVE-2026-103635 osv.dev
- Apache mailing list thread lists.apache.org
- oss-security post www.openwall.com
- Upstream pull request 536 (buffer size check in compact Theta preamble) github.com
- DataSketches PostgreSQL extension pull request 80 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:01.
Original description (NVD)
Out-of-bounds read in the compact Theta sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). compact_theta_sketch::deserialize() and wrapped_compact_theta_sketch::wrap() read header fields before checking that the input was long enough. For the compressed format, the size check could be defeated by a 32-bit overflow, and two header fields that control decoding were not validated; this also affected deserialization from a stream. A crafted or truncated sketch could cause a read past the end of the input. In the compressed case the over-read can be large, and the bytes read can become part of the deserialized sketch. This can cause a crash (denial of service) and could expose adjacent memory contents. This issue affects Apache DataSketches C++: from 3.1.0 before 5.3.0. Only applications that deserialize Theta sketches from untrusted sources are affected. Users are recommended to upgrade to version 5.3.0, which fixes this issue.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.