{
  "threat_severity" : "Low",
  "public_date" : "2026-07-04T23:30:10Z",
  "bugzilla" : {
    "description" : "org.hdrhistogram/HdrHistogram: HdrHistogram: HdrHistogram: Denial of Service via uncontrolled memory allocation in decodeFromByteBuffer",
    "id" : "2497103",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2497103"
  },
  "cvss3" : {
    "cvss3_base_score" : "5.0",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-770",
  "details" : [ "A flaw has been found in HdrHistogram up to 2.2.2. This affects the function org.HdrHistogram.AbstractHistogram.decodeFromByteBuffer of the file src/main/java/org/HdrHistogram/AbstractHistogram.java. This manipulation of the argument numberOfSignificantValueDigits causes uncontrolled memory allocation. The attack can only be executed locally. The exploit has been published and may be used. The actual existence of this vulnerability is currently in question. This issue is disputed due to the potential lack of crossing of security boundaries and the pre-requisites for a successful attack.", "A flaw was found in HdrHistogram. A local attacker can exploit a vulnerability in the `decodeFromByteBuffer` function by manipulating the `numberOfSignificantValueDigits` argument. This manipulation leads to uncontrolled memory allocation, which can result in a Denial of Service (DoS) condition, making the affected system or application unavailable." ],
  "statement" : "Successful exploitation requires local access, as an attacker must be able to supply specially crafted, manipulated input directly to an application that is actively utilizing the affected HdrHistogram library.\nThe vulnerability is strictly limited to causing a Denial of Service (DoS) via uncontrolled memory allocation. It does not allow an attacker to execute arbitrary code, escalate privileges, or access unauthorized data. \nFurthermore, the impact is localized to the specific application processing the malicious input, rather than causing a broader, system-wide compromise.",
  "affected_release" : [ {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-06-18T00:00:00Z",
    "advisory" : "RHSA-2026:26989",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "netavark-main-2.0.0-1.hum1",
    "impact" : "moderate"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-07-02T00:00:00Z",
    "advisory" : "RHSA-2026:34975",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "rust-main-1.96.1-1.hum1",
    "impact" : "moderate"
  } ],
  "package_state" : [ {
    "product_name" : "Logging Subsystem for Red Hat OpenShift",
    "fix_state" : "Fix deferred",
    "package_name" : "openshift-logging/vector-rhel9",
    "cpe" : "cpe:/a:redhat:logging:6"
  }, {
    "product_name" : "OpenShift Lightspeed",
    "fix_state" : "Fix deferred",
    "package_name" : "openshift-lightspeed/lightspeed-ocp-rag-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_lightspeed"
  }, {
    "product_name" : "OpenShift Lightspeed",
    "fix_state" : "Fix deferred",
    "package_name" : "openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_lightspeed"
  }, {
    "product_name" : "OpenShift Service Mesh 3",
    "fix_state" : "Fix deferred",
    "package_name" : "openshift-service-mesh/istio-ztunnel-rhel9",
    "cpe" : "cpe:/a:redhat:service_mesh:3"
  }, {
    "product_name" : "Red Hat Ansible Automation Platform 2",
    "fix_state" : "Fix deferred",
    "package_name" : "ansible-automation-platform-25/lightspeed-chatbot-rhel8",
    "cpe" : "cpe:/a:redhat:ansible_automation_platform:2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Fix deferred",
    "package_name" : "HdrHistogram",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Fix deferred",
    "package_name" : "rhoai/odh-llm-d-inference-scheduler-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Fix deferred",
    "package_name" : "rhoai/odh-model-registry-job-async-upload-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Fix deferred",
    "package_name" : "conmon-rs",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Update Service",
    "fix_state" : "Fix deferred",
    "package_name" : "openshift-update-service/openshift-update-service-rhel8",
    "cpe" : "cpe:/a:redhat:openshift_update_service:5"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-14684\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-14684\nhttps://github.com/HdrHistogram/HdrHistogram/\nhttps://github.com/HdrHistogram/HdrHistogram/issues/220\nhttps://vuldb.com/cve/CVE-2026-14684\nhttps://vuldb.com/submit/846754\nhttps://vuldb.com/vuln/376280\nhttps://vuldb.com/vuln/376280/cti" ],
  "name" : "CVE-2026-14684",
  "mitigation" : {
    "value" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
    "lang" : "en:us"
  },
  "csaw" : false
}