{"vulnerability": "CVE-2026-103501", "sightings": [{"uuid": "a54e2014-dbeb-427e-a538-bc2758d1ca6e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-103501", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117416163574564113", "content": "CVE-2026-103501 Apache DataSketches: datasketches-cpp: HLL CouponList Deserialization Buffer Overflow allows memory corruption via a crafted sketch Heap buffer overflow in the HLL sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp).\nWhen deserializing a sketch in LIST mode, from either a byte buffer or a stream, the coupon count was read from the input and used as the number of entries to copy into a fixed buffer of 8 entries, without checking it against the buffer's capacity. A crafted sketch could cause a write of up to 988 bytes past the end of this internal heap buffer. This can corrupt heap memory, causing a crash and potentially enabling further exploitation.\nThis issue affects Apache DataSketches C++: from 1.0.0-incubating before 5.3.0. Only applications that deserialize HLL sketches from untrusted sources are affected.\nUsers are recommended to upgrade to version 5.3.0, which fixes this issue.\nhttps://www.cve.org/CVERecord?id=CVE-2026-103501https://lists.apache.org/thread/n2oc2j841dzsv4239jjp08of66bo79c5https://github.com/apache/datasketches-cpp/releases/tag/5.3.0#apache #ApacheSoftwareFoundation #ApacheDataSketches#CVE_2026_103501#bot", "creation_timestamp": "2026-10-10T10:34:33.040614Z"}, {"uuid": "1c5aca86-9c88-49e6-b83f-d5bb4e63ab0c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-103501", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mxjcrdc5gi2l", "content": "CVE-2026-103501: Apache patched three memory-corruption flaws in DataSketches C++ (datasketches-cpp), affecting versions up to 5.2.0. Crafted sketches from untrusted sources can corrupt heap memory. Fixed in 5.3.0. No exploitation reported.", "creation_timestamp": "2026-10-10T10:46:50.028738Z"}, {"uuid": "b4de89a7-8c8b-42c1-b2f4-00fac08325ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-103501", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/2mwqncpmcs3vt", "content": "CVE-2026-103501: Apache DataSketches: datasketches-cpp: HLL CouponList Deserialization Buffer Overflow allows memory corruption via a crafted sketch", "creation_timestamp": "2026-10-10T11:01:12.718531Z"}]}