Apache DataSketches C++ 5.3.1

Apache DataSketches C++ 5.3.1

This is a bug fix release on top of 5.3.0. It contains fixes for critical bugs, including stricter validation of serialized sketches. There are no new features, and no API changes other than the checks noted below. Users of 5.3.0 can upgrade without changing their code.

Security fixes

This release fixes two vulnerabilities in sketch deserialization. They affect only applications that deserialize sketches from untrusted sources. Users who do so should upgrade to 5.3.1.

• CVE-2026-123274 (moderate): out-of-bounds write in KLL sketch deserialization. Affects all releases through 5.3.0. Reported by hataehoon. Advisory
• CVE-2026-123338 (moderate): out-of-bounds write in REQ sketch deserialization. Affects 3.0.0 through 5.3.0. Advisory

The fixes are the KLL and REQ deserialization checks listed under Bug fixes below. They reached master in #568.

Behavior changes

• Array of doubles and array tuple: update() on a union or intersection now throws std::invalid_argument when the sketch's number of values differs from the policy's, matching datasketches-java. Previously the mismatch wasn't detected and the result was undefined (#546).
• REQ: a k of 256 or more is now honored. Previously it was truncated to 8 bits, so req_sketch<float>(500).get_k() returned 244 (#552).
• Deserialization: malformed or truncated KLL, REQ and classic Quantiles images are now rejected with an exception. Images written by valid sketches are unaffected.

Bug fixes

• KLL: deserialize() now checks k, the number of levels and the levels array (#568).
• REQ: deserialize() now checks k and the compactor headers, in both the stream and bytes overloads (#568).
• Quantiles: the bytes overload of deserialize() now checks the input size before reading the serial version 1 field (#568).
• Array of doubles and array tuple: union and intersection check the number of values (#546).
• REQ: k is no longer truncated to 8 bits (#552).
• t-digest: serialize(header_size_bytes) now includes the header in the buffer size (#563). Reported by Hyeonho Kim.
• Common: copy_from_mem() and copy_to_mem() no longer call memcpy with a size of zero, which is undefined behavior with a null pointer (#548).

Custom allocators

• HLL: hll_union no longer keeps memory owned by the input sketches' allocators (#556).
• EBPPS: ebpps_sketch::merge(const&) no longer fails to compile with an allocator from an application's namespace (#557).
• Count-Min: the hash seeds now use the sketch's allocator instead of std::allocator (#559).
• Density: density_sketch now works with a custom allocator (#562).

Licensing and documentation

• LICENSE no longer lists Catch2, which isn't part of the source distribution. NOTICE now reads "Copyright 2019-2026 The Apache Software Foundation". The README states the correct minimum CMake version (#541).

Contributors

Thanks to everyone who contributed to this release: @leerho, @proost, @rustyconover, @tisonkun. Thanks also to hataehoon for reporting CVE-2026-123274.

Full Changelog: 5.3.0...5.3.1