CVE-2026-103636: out-of-bounds read in Apache DataSketches VarOpt union deserialization

The advisory, published by Lee Rhodes on October 10 on the oss-sec list and machine-translated in the feed, describes CVE-2026-103636 in Apache DataSketches C++ (the datasketches-cpp repository). Affected versions: from 2.0.0-incubating through 5.2.0. The stated severity is low. The issue is in var_opt_union::deserialize(): the routine read the 32-byte preamble of a non-empty union after checking that only 8 bytes were available. As a result, a truncated serialized union can cause a read of up to 24 bytes past the end of the input, leading to denial of service. The feed text appears cut off, so further details, such as the fixed version, should be checked in the original source. Relevance: systems that deserialize data from untrusted sources may be affected. How to verify: confirm whether your application depends on datasketches-cpp, identify the version in use, and consult the official Apache project advisory for the fixed release. Rota Nacional does not patch third-party libraries, and this advisory does not involve a platform feature.