---
id: CVE-2026-87822
title: >-
  t-digest versions 3.1 through 3.3 fail to validate centroid means during
  deserialization in MergingDigest.fromBytes, allowing attackers to inject NaN
  values that bypass validation checks
summary: >-
  t-digest versions 3.1 through 3.3 fail to validate centroid means during
  deserialization in MergingDigest.fromBytes, allowing attackers to inject NaN
  values that bypass validation checks. Attackers can craft malicious serialized
  digests …
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-407
vendor: tdunning
product: t-digest
affected:
  - t-digest >= 3.1 <= 3.3
published: '2026-09-09'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T15:17:54.100'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-87822'
references:
  - url: 'https://github.com/tdunning/t-digest'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/tdunning/t-digest/blob/8d5c1523c3d46925e9b3979a8d63c0b9d004ed1c/core/src/main/java/com/tdunning/math/stats/MergingDigest.java
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/tdunning/t-digest/blob/8d5c1523c3d46925e9b3979a8d63c0b9d004ed1c/core/src/main/java/com/tdunning/math/stats/Sort.java
    label: disclosure@vulncheck.com
  - url: 'https://github.com/tdunning/t-digest/issues/229'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/t-digest-3.1-through-3.3-denial-of-service-via-nan-centroid-means-in-mergingdigest-frombytes
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-10T14:22:28.894428Z'
ingestedAt: '2026-09-13T09:28:35.871Z'
epss: 0.0067
epssPercentile: 0.49874
---

## Overview

t-digest versions 3.1 through 3.3 fail to validate centroid means during deserialization in MergingDigest.fromBytes, allowing attackers to inject NaN values that bypass validation checks. Attackers can craft malicious serialized digests containing NaN centroids that degrade sorting performance from O(n log n) to O(n squared), causing severe processing delays during merge operations.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.