Cyber ·
CVE-2026-123338: out-of-bounds write in REQ sketch deserialization in Apache DataSketches C++
Moderate-severity advisory: a crafted REQ sketch can corrupt heap memory during deserialization in Apache DataSketches C++ versions 3.0.0 through 5.3.0, because serialized compressor headers are not validated.
The advisory describes an out-of-bounds write vulnerability in Apache DataSketches C++, a library of probabilistic sketches used for estimates over large data volumes. According to the text, the flaw affects versions 3.0.0 through 5.3.0 and has moderate severity. An application that deserializes a REQ sketch from an untrusted source can have its heap memory corrupted by a sketch built for that purpose, because serialized compressor headers are not validated. The material was posted on the oss-sec list on 12 November and carried in the security feed dated 13 November 2026. The available text is an automatic translation and ends incompletely, so the official fix guidance should be checked in the original source and in the Apache project release notes. Rota Nacional does not patch third-party libraries and does not present itself as a solution to this engineering problem. For teams using the library, the basic steps are to identify whether any affected version is in production, upgrade to a fixed version once the project indicates one, and avoid deserializing data from untrusted sources until then. When the topic has no direct link to personal data, protecting organizational data depends on the system's own controls. If your team uses AI to study the advisory or draft fix code, do not paste excerpts containing real customer data, credentials or internal paths.