CyberRota Analysis
AI-GeneratedVersions 3.1 to 3.3 of t-digest are vulnerable due to inadequate validation of centroid means during deserialization, permitting attackers to inject NaN values. This flaw can lead to significant performance degradation in sorting operations, increasing processing time from O(n log n) to O(n squared) during merges. Organizations utilizing affected versions should prioritize remediation to mitigate the risk of operational delays and potential denial of service.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
t-digest versions 3.1 through 3.3 fail to validate centroid means during deserialization in MergingDigest.fromBytes, allowing attackers to inject NaN values that bypass validation checks. Attackers can craft malicious serialized digests containing NaN centroids that degrade sorting performance from O(n log n) to O(n squared), causing severe processing delays during merge operations.