Apache Software Foundation Apache Datasketches vulnerabilities

4 CVEs affecting Apache Software Foundation Apache Datasketches, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-103636, published 2026-10-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-103501, published 2026-10-10. Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days. Heap buffer overflow in the HLL sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). When deserializing a sketch in LIST mode, from either a byte buffer or a stream, the…
CVE-2026-103635, published 2026-10-10. Critical severity, CVSS 9.1. EPSS: 0.6% chance of exploitation in the next 30 days. Out-of-bounds read in the compact Theta sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). compact_theta_sketch::deserialize() and wrapped_compact_theta_sketch::wrap() read…
CVE-2026-103636, published 2026-10-10. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. Out-of-bounds read in the VarOpt union deserialization of Apache DataSketches C++ (repo: datasketches-cpp). var_opt_union::deserialize() read the 32-byte preamble of a non-empty union after checking…
CVE-2026-103513, published 2026-10-10. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. Out-of-bounds read and write in the CPC sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). A crafted serialized CPC sketch passed to cpc_sketch::deserialize(), from either a…