NVD Published: 2026-10-10
This article was published on October 12, 2026.
Preface: While modern large language model (LLM) architectures scale efficiently across compute-heavy workloads, managing high-throughput auxiliary data streams remains a critical infrastructural challenge. When integrating streaming data frameworks—specifically Apache DataSketches—into LLM production platforms for systems like observability logging, prompt analysis, and user history tracking, the Frequent Items (Heavy Hitters) sketch frequently emerges as the primary performance bottleneck due to its dynamic map overheads and memory-update complexities under massive data ingestion.
Background: Regarding CVE-2026-103635, this explanation requires reference to the attached infographic. In the context presented by infographics, CVE-2026-103635 explicitly flags the exact two APIs you are utilizing in Part 2 of your central controller:
i.compact_theta_sketch::deserialize() (Used on Node A’s payload)
ii.wrapped_compact_theta_sketch::wrap() (Used on Node B’s payload)
How the Flaw Works
The vulnerability stems from the library parsing header data inside those functions before checking if the provided memory buffer size (.size()) is long enough to safely accommodate them. For compressed layouts, a 32-bit integer overflow can invalidate internal size checks.
If an attacker intercepts or controls the raw network data feeding into node_A_data.theta_binary or node_B_data.theta_binary, they can pass a truncated or deliberately crafted byte buffer. This causes the parser to read past the end of the vector boundaries, resulting in:
•Denial of Service (DoS): Segfaults/application crashes in your high-performance gateway.
•Information Disclosure: Memory bleeding where data adjacent to your network buffers leaks into the resulting state of the deserialized sketch.
Vulnerability details: Out-of-bounds read in the compact Theta sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). compact_theta_sketch::deserialize() and wrapped_compact_theta_sketch::wrap() read header fields before checking that the input was long enough. For the compressed format, the size check could be defeated by a 32-bit overflow, and two header fields that control decoding were not validated; this also affected deserialization from a stream. A crafted or truncated sketch could cause a read past the end of the input. In the compressed case the over-read can be large, and the bytes read can become part of the deserialized sketch. This can cause a crash (denial of service) and could expose adjacent memory contents. This issue affects Apache DataSketches C++: from 3.1.0 before 5.3.0. Only applications that deserialize Theta sketches from untrusted sources are affected.
Official announcement: Please refer to the link for details – https://www.tenable.com/cve/CVE-2026-103635