Description

t-digest versions 3.1 through 3.3 fail to validate centroid means during deserialization in MergingDigest.fromBytes, allowing attackers to inject NaN values that bypass validation checks. Attackers can craft malicious serialized digests containing NaN centroids that degrade sorting performance from O(n log n) to O(n squared), causing severe processing delays during merge operations.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-09T15:17:27.427Z",
  "pubdate": "2026-09-09T15:17:27.427Z",
  "executiveSummary": "A vulnerability exists in t-digest versions 3.1 through 3.3 regarding the deserialization process of MergingDigest objects. The implementation fails to perform adequate input validation on centroid means during the reconstruction of objects from byte arrays.\nThis oversight allows an attacker to inject 'Not-a-Number' (NaN) values into the digest's centroid data. Because the internal sorting mechanisms rely on comparisons that fail when encountering NaN, the introduction of these values corrupts the digest's integrity.\nThe primary risk implication is a denial-of-service (DoS) condition triggered by algorithmic complexity degradation. An attacker can craft a malicious serialized payload that forces the system into an O(n squared) sorting performance during subsequent merge operations, as opposed to the expected O(n log n) efficiency.\nThe vulnerability requires the attacker to successfully deliver a malformed serialized object to a system that processes t-digest data. Successful exploitation leads to severe processing delays, resource exhaustion, and potential system instability, depending on the volume of digest operations performed.",
  "technicalDetails": "The vulnerability resides within the MergingDigest.fromBytes function, which is responsible for reconstructing a MergingDigest object from a serialized byte stream. The root cause is the absence of verification logic to ensure that floating-point values representing centroid means are valid, finite numbers.\nWhen a MergingDigest is deserialized, the class reads the centroid means from the byte stream. If the input stream is manipulated, an attacker can embed NaN values into these means. In IEEE 754 floating-point arithmetic, NaN values are defined such that any comparison (e.g., <, >, or ==) involving a NaN result in false.\nThe sorting logic within the MergingDigest relies on these comparisons to maintain the internal ordering of centroids. When NaN values are injected, the comparator function becomes non-transitive or inconsistent, effectively breaking the requirements for standard sorting algorithms. Specifically, when the digest attempts to perform a merge or re-sort, the sorting algorithm enters a degraded state.\nExploitation flow: 1. The attacker creates a serialized MergingDigest payload containing one or more centroids with NaN values. 2. The attacker delivers this payload to an endpoint or service that utilizes MergingDigest.fromBytes to process user-provided or stored digest data. 3. Upon deserialization, the malicious object is instantiated with the corrupted NaN centroid values. 4. When the application invokes a method that triggers a merge or sort (such as adding data to the digest or merging multiple digests), the affected sorting algorithm attempts to order the centroids. 5. Due to the presence of NaN, the comparison logic fails to stabilize the sort, forcing the algorithm to fall back to a degenerate case with quadratic complexity (O(n squared)).\nThis behavior results in significant CPU exhaustion and increased latency. In high-throughput environments, this effectively stalls the processing pipeline, leading to a denial-of-service. The component is inherently vulnerable because the fromBytes function trusts the input data implicitly without validating the numerical sanity of the serialized fields.\nThere are no specific authentication or privilege requirements for this exploit, provided the attacker can submit serialized objects to the vulnerable service. The vulnerability is highly effective in any application context that relies on t-digest for performance-critical data aggregation."
}