CVE-2026-14686

EUVD-2026-41708

05.07.2026, 01:21

A vulnerability was found in HdrHistogram up to 2.2.2. This issue affects the function org.HdrHistogram.DoubleHistogram.recordValue of the file src/main/java/org/HdrHistogram/DoubleHistogram.java of the component Range Check. Performing a manipulation results in incorrect comparison. The attack is only possible with local access. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	3.3 LOW	LOCAL	LOW	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: 15%

Debian Releases

Debian Product

Codename

hdrhistogram

bookworm	vulnerable
bullseye	vulnerable
forky	vulnerable
sid	vulnerable
trixie	postponed

Common Weakness Enumeration

CWE-697 - Incorrect Comparison
The software compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.

References

https://github.com/HdrHistogram/HdrHistogram/

https://github.com/HdrHistogram/HdrHistogram/issues/222

https://vuldb.com/cve/CVE-2026-14686

https://vuldb.com/submit/846762

https://vuldb.com/vuln/376282

https://vuldb.com/vuln/376282/cti