Hello All, The Apache DataSketches PMC is pleased to announce the release of Apache DataSketches-cpp 5.3.1.
*About DataSketches-cpp* This is the core C++ component of the DataSketches library. It includes all of the sketch algorithms as a header-only C++11 library, and it is the basis for the DataSketches Python Library, PostgreSQL adaptor, Google BigQuery Adaptor, and the upcoming DataSketches CUDA Library *Summary* This is a bug fix release on top of 5.3.0. There are no new features, and users of 5.3.0 can upgrade without changing their code. *Highlights* - Security fixes for two vulnerabilities in sketch deserialization. They affect only applications that deserialize sketches from untrusted sources. We recommend that those users upgrade. - CVE-2026-123274 (moderate): out-of-bounds write in KLL sketch deserialization. Affects 1.0.0-incubating through 5.3.0. https://www.cve.org/CVERecord?id=CVE-2026-123274 - CVE-2026-123338 (moderate): out-of-bounds write in REQ sketch deserialization. Affects 3.0.0 through 5.3.0. https://www.cve.org/CVERecord?id=CVE-2026-123338 - Stricter validation of serialized KLL, REQ and classic Quantiles sketches: malformed or truncated input is now rejected with an exception. Images written by valid sketches are unaffected. - Bug fixes: array tuple union and intersection now check the number of values, as datasketches-java does; a REQ k of 256 or more is no longer truncated to 8 bits; t-digest serialize() with a header now allocates enough space; and several fixes for custom allocators in HLL, EBPPS, Count-Min and Density. Two behavior changes: array tuple union and intersection now throw std::invalid_argument when the number of values doesn't match, and the deserialization checks above reject invalid images that 5.3.0 accepted. For more details, please see the release notes: https://github.com/apache/datasketches-cpp/releases/tag/5.3.1 *Links* - DataSketches Download Site: https://datasketches.apache.org/docs/Community/Downloads.html - C++ Code Documentation: https://apache.github.io/datasketches-cpp/5.3.1/ - Security advisories: https://datasketches.apache.org/docs/Community/Security.html - Releases: https://github.com/apache/datasketches-cpp/releases - Developer build and test documentation: https://github.com/apache/datasketches-cpp/blob/5.3.1/README.md - DataSketches Website: https://datasketches.apache.org Thank you to the PMC members and the community for reviewing this release, to everyone who contributed to it, and to hataehoon for reporting CVE-2026-123274! Lee. [email protected]
