CVE-2026-102554
published 2026-10-09CVE-2026-102554: Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an…
PriorityP345high8.2CVSS 4.0
AVNACLATPPRNUINVCNVINVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.35%
27.6th percentile
Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams.
Affected
60 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | thrift | — | — |
| candlepinproject | candlepin | — | — |
| debian | ceph | — | — |
| devspaces | jetbrains-ide-rhel9 | — | — |
| devspaces | openvsx-rhel9 | — | — |
| devspaces | pluginregistry-rhel9 | — | — |
| devspaces | server-rhel9 | — | — |
| devspaces | udi-rhel9 | — | — |
| exploit-intelligence | agent-client-rhel9 | — | — |
| exploit-intelligence | vulnerability-analysis-rhel9 | — | — |
| guava | — | — | |
| guava | >= 4.0 < 33.7.2 | 33.7.2 | |
| protobuf | — | — | |
| javapackages-tools_201801 | maven-shade-plugin | — | — |
| jboss-eap-7 | eap74-els-openjdk11-openshift-rhel8 | — | — |
| jboss-eap-7 | eap74-els-openjdk17-openshift-rhel8 | — | — |
| jboss-eap-7 | eap74-els-openjdk8-openshift-rhel8 | — | — |
| jboss-eap-8-tech-preview | eap81-openjdk17-builder-openshift-rhel9 | — | — |
| jboss-eap-8-tech-preview | eap81-openjdk21-builder-openshift-rhel9 | — | — |
| jboss-eap-8 | eap81-openjdk17-builder-openshift-rhel9 | — | — |
| jenkins | jenkins | — | — |
| mta | mta-cli-rhel9 | — | — |
| mta | mta-java-external-provider-rhel9 | — | — |
| ocp-tools-4 | jenkins-rhel8 | — | — |
| ocp-tools-4 | jenkins-rhel9 | — | — |
CVSS provenance
nvdv4.08.2HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization
vendor_redhat·2026-10-09·CVSS 8.2
CVE-2026-102554 [HIGH] CWE-770 com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization
com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization
Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams.
A flaw was found in Google Guava. During Java object deserialization—the process of converting stored data back into active program objects—memory is eagerly allocated based on caller-specified size parameters without proper th
VulDB
Google Guava up to 33.7.1 CompactHashMap size allocation of resources
vuldb·2026-10-09·CVSS 8.2
CVE-2026-102554 [HIGH] Google Guava up to 33.7.1 CompactHashMap size allocation of resources
A vulnerability marked as problematic has been reported in Google Guava up to 33.7.1. Impacted is an unknown function of the component CompactHashMap. The manipulation of the argument size leads to allocation of resources.
This vulnerability is uniquely identified as CVE-2026-102554. The attack is possible to be carried out remotely. No exploit exists.
It is suggested to upgrade the affected component.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-102554 maven: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
bugzilla·2026-10-19·CVSS 8.2
CVE-2026-102554 [HIGH] CVE-2026-102554 maven: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
CVE-2026-102554 maven: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization
Bugzilla
CVE-2026-102554 javaparser: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
bugzilla·2026-10-19·CVSS 8.2
CVE-2026-102554 [HIGH] CVE-2026-102554 javaparser: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
CVE-2026-102554 javaparser: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serializa
Bugzilla
CVE-2026-102554 google-guice: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
bugzilla·2026-10-19·CVSS 8.2
CVE-2026-102554 [HIGH] CVE-2026-102554 google-guice: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
CVE-2026-102554 google-guice: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted seriali
Bugzilla
CVE-2026-102554 selenium-manager: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
bugzilla·2026-10-19·CVSS 8.2
CVE-2026-102554 [HIGH] CVE-2026-102554 selenium-manager: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
CVE-2026-102554 selenium-manager: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted ser
Bugzilla
CVE-2026-102554 qt5-qtwebengine: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
bugzilla·2026-10-19·CVSS 8.2
CVE-2026-102554 [HIGH] CVE-2026-102554 qt5-qtwebengine: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
CVE-2026-102554 qt5-qtwebengine: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted seri
Bugzilla
CVE-2026-102554 auto: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
bugzilla·2026-10-19·CVSS 8.2
CVE-2026-102554 [HIGH] CVE-2026-102554 auto: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
CVE-2026-102554 auto: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization s
Bugzilla
CVE-2026-102554 libphonenumber: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
bugzilla·2026-10-19·CVSS 8.2
CVE-2026-102554 [HIGH] CVE-2026-102554 libphonenumber: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
CVE-2026-102554 libphonenumber: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted seria
Bugzilla
CVE-2026-102554 google-gson: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [epel-all]
bugzilla·2026-10-19·CVSS 8.2
CVE-2026-102554 [HIGH] CVE-2026-102554 google-gson: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [epel-all]
CVE-2026-102554 google-gson: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serializat
Bugzilla
CVE-2026-102554 log4j: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
bugzilla·2026-10-19·CVSS 8.2
CVE-2026-102554 [HIGH] CVE-2026-102554 log4j: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
CVE-2026-102554 log4j: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization
Bugzilla
CVE-2026-102554 moditect: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
bugzilla·2026-10-19·CVSS 8.2
CVE-2026-102554 [HIGH] CVE-2026-102554 moditect: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
CVE-2026-102554 moditect: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serializati
Bugzilla
CVE-2026-102554 google-gson: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
bugzilla·2026-10-19·CVSS 8.2
CVE-2026-102554 [HIGH] CVE-2026-102554 google-gson: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
CVE-2026-102554 google-gson: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serializ
Bugzilla
CVE-2026-102554 byte-buddy: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
bugzilla·2026-10-19·CVSS 8.2
CVE-2026-102554 [HIGH] CVE-2026-102554 byte-buddy: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
CVE-2026-102554 byte-buddy: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serializa
Bugzilla
CVE-2026-102554 ceph: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
bugzilla·2026-10-19·CVSS 8.2
CVE-2026-102554 [HIGH] CVE-2026-102554 ceph: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
CVE-2026-102554 ceph: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization s
Bugzilla
CVE-2026-102554 clojure-maven-plugin: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
bugzilla·2026-10-19·CVSS 8.2
CVE-2026-102554 [HIGH] CVE-2026-102554 clojure-maven-plugin: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
CVE-2026-102554 clojure-maven-plugin: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted
Bugzilla
CVE-2026-102554 assertj-core: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
bugzilla·2026-10-19·CVSS 8.2
CVE-2026-102554 [HIGH] CVE-2026-102554 assertj-core: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
CVE-2026-102554 assertj-core: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted seriali
Bugzilla
CVE-2026-102554 libphonenumber: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [epel-all]
bugzilla·2026-10-19·CVSS 8.2
CVE-2026-102554 [HIGH] CVE-2026-102554 libphonenumber: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [epel-all]
CVE-2026-102554 libphonenumber: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted seriali
Bugzilla
CVE-2026-102554 maven4: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
bugzilla·2026-10-19·CVSS 8.2
CVE-2026-102554 [HIGH] CVE-2026-102554 maven4: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
CVE-2026-102554 maven4: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization
Bugzilla
CVE-2026-102554 plexus-compiler: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
bugzilla·2026-10-19·CVSS 8.2
CVE-2026-102554 [HIGH] CVE-2026-102554 plexus-compiler: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
CVE-2026-102554 plexus-compiler: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted seri
Bugzilla
CVE-2026-102554 cldr-emoji-annotation: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
bugzilla·2026-10-19·CVSS 8.2
CVE-2026-102554 [HIGH] CVE-2026-102554 cldr-emoji-annotation: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
CVE-2026-102554 cldr-emoji-annotation: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafte
Bugzilla
CVE-2026-102554 guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
bugzilla·2026-10-15·CVSS 8.2
CVE-2026-102554 [HIGH] CVE-2026-102554 guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
CVE-2026-102554 guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization
Bugzilla
CVE-2026-102554 javapackages-bootstrap: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
bugzilla·2026-10-15·CVSS 8.2
CVE-2026-102554 [HIGH] CVE-2026-102554 javapackages-bootstrap: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
CVE-2026-102554 javapackages-bootstrap: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from craft
Bugzilla
CVE-2026-102554 com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization
bugzilla·2026-10-09·CVSS 8.2
CVE-2026-102554 [HIGH] CVE-2026-102554 com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization
CVE-2026-102554 com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization
Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams.
2026-10-09
Published