Cyber ·
CVE-2026-123274: out-of-bounds write in KLL sketch deserialization in Apache DataSketches C++
Moderate-severity advisory posted to oss-sec on 12 November: a malicious KLL sketch can corrupt heap memory when deserialized in Apache DataSketches C++, versions 2.0.0-incubating through 5.3.0.
Radar records advisory CVE-2026-123274 on Apache DataSketches C++. According to the text received, the flaw is an out-of-bounds write, published by Lee Rhodes on 12 November 2026, with a rated severity of moderate. The affected versions listed run from 2.0.0-incubating through 5.3.0. The description says an application that deserializes a KLL sketch from an untrusted source can have its heap memory corrupted by a sketch crafted for that purpose, because the serialized level boundaries are not validated.
The text received is an automatic translation of the oss-sec feed content and is truncated, so it does not include full remediation guidance or details on fixed versions. To consult the original, search for the identifier CVE-2026-123274 and the oss-sec message of 12 November 2026 in the list's public archive. Also check the Apache DataSketches project notes and the official CVE database before acting.
The relevance for library users is to check whether any application deserializes sketches from untrusted sources, and to update to a fixed version once the project publishes one. This kind of flaw is not a privacy issue of the Rota Nacional platform, and Rota does not patch third-party libraries.