CVE-2026-103634 Apache Software Foundation CVE debrief

Who should care

Defenders of systems using Apache DataSketches C++ should assess exposure, especially if deserializing Count-Min sketches from untrusted sources. They should verify deserialization practices, review compensating controls for exposed systems, and check relevant monitoring, detection, and logs for exposed assets. Upgrading to version 5.3.0 is recommended to mitigate this vulnerability.

Why it matters

CVE-2026-103634 allows memory corruption via crafted Count-Min sketches in Apache DataSketches C++ versions before 5.3.0. Defenders should assess exposure, verify deserialization practices, and upgrade to version 5.3.0.

• Memory corruption via crafted sketches
• Potential crash and further exploitation
• Verification of deserialization practices required
• Upgrade to version 5.3.0 recommended

Technical summary

Out-of-bounds read and write in Count-Min sketch deserialization allows memory corruption via a crafted sketch in Apache DataSketches C++ versions from 4.1.0 before 5.3.0. The count_min_sketch::deserialize() function did not include the preamble in its input size check, potentially leading to reads of up to 16 bytes past the end of the input. The table size computation using 32-bit arithmetic could also wrap to zero, causing deserialization with an empty table. This can corrupt heap memory, causing a crash and potentially enabling further exploitation.

Defensive priority

Upgrade to version 5.3.0, assess exposure, and verify deserialization practices

Recommended defensive actions

• Upgrade Apache DataSketches C++ to version 5.3.0
• Assess exposure to untrusted Count-Min sketches
• Verify deserialization practices for Count-Min sketches
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

Out-of-bounds read and write in Count-Min sketch deserialization allows memory corruption via a crafted sketch in Apache DataSketches C++ versions from 4.1.0 before 5.3.0. The issue arises from the count_min_sketch::deserialize() function not including the preamble in its input size check, potentially leading to reads past the end of the input. Additionally, 32-bit arithmetic used for computing the table size from serialized values could result in

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.