Vulnerability-Lookup

SUSE-SU-2026:24263-1

Vulnerability from csaf_suse - Published: 2026-10-20 13:36 - Updated: 2026-10-23 09:42

Summary

Security update for guava

Severity

Important

Notes

Title of the patch: Security update for guava

Description of the patch: This update for guava fixes the following issue: - CVE-2026-102554: Allocation of resources without limits or throttling (CWE-770) during Java object deserialization allows an attacker to cause a Denial of Service via OutOfMemoryError (bsc#1284985). Changes for guava: - Adapt the generated OSGi data to reality - Upgrade to guava 33.7.2 * Changes of 33.7.2 + collect: Changed MapMaker, CompactHashMap, and CompactHashSet deserialization to avoid eagerly allocating as much memory as a serialization payload requests (bsc#1284985, CVE-2026-102554) * Changes of 33.7.1 + removes the Multi-Release line from our jar manifest, fixing an issue under Java 9 and 10 that was introduced to guava-jre in version 33.7.0. * Changes of 33.7.0 + Guava module-info.class is now present at the root of the jar instead of under a multi-release root. This prevents the jar from containing a file at META-INF/versions/9/OSGI-INF/ /MANIFEST.MF, which occasionally causes trouble for some users + collect: Changed some ImmutableMap implementations to create a new, lightweight object on each call to view methods like keySet(), rather than creating and storing that object during the first call for reuse later. This is likely to slightly improve performance for some users, but it could lead to regressions in unusual cases, such as repeatedly calling asMultimap().inverse() on the same ImmutableMap instance. + net: Added HttpHeaders constant for on-prefetch-activation. + net: Added MediaType constants for application/yaml and application/x-pem-file. + util.concurrent: Fixed ExecutionSequencer queue stall when delegate executor throws RejectedExecutionException. * Changes of 33.6.0 + Migrated some classes from finalize() to PhantomReference in preparation for the removal of finalization. + cache: Deprecated CacheBuilder APIs that use TimeUnit in favor of those that use Duration. + collect: Added toImmutableSortedMap collectors that use the natural comparator. + collect: Changed ConcurrentHashMultiset, ImmutableMultimap, and TreeMultiset deserialization to avoid mutating final fields. In extremely unlikely scenarios in which an instance of that type contains an object that refers back to that instance, this could lead to a broken instance that throws NullPointerException when used. + graph: Removed @Beta from all APIs in the package. + graph: Added support to Graphs.transitiveClosure() for different strategies for adding self-loops. + graph: Added an asNetwork() view to Graph and ValueGraph. + hash: Added BloomFilter.serializedSize(). + net: Added HttpHeaders.CDN_CACHE_CONTROL. * Changes of 33.5.0 + For users of guava-gwt: Google has moved off GWT internally. We plan to continue to release guava-gwt for users of GWT and J2CL, but the artifact is no longer tested for GWT-specific issues, and we have limited resources to fix any unexpected issues that might arise. While we do not anticipate any specific problems, we can't guarantee how long support will continue. + Listed the JSpecify annotations as an optional dependency in our OSGi metadata. + cache: Improved the handling of exceptions from compute functions in Cache.asMap(). (We do still recommend using Caffeine rather than com.google.common.cache.) + collect: Improved Iterators.mergeSorted() to preserve stability for equal elements. + math: Added saturatedAbs methods to IntMath and LongMath. + net: Added image/avif to MediaType. + util.concurrent: Added Striped.custom.

Patchnames: SUSE-SLES-16.0-1947

CVE-2026-102554

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 6 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Server 16.0:guava-0:33.7.2-160000.1.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:guava-javadoc-0:33.7.2-160000.1.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:guava-testlib-0:33.7.2-160000.1.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:guava-0:33.7.2-160000.1.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:guava-javadoc-0:33.7.2-160000.1.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:guava-testlib-0:33.7.2-160000.1.1.noarch	—	Vendor Fix

Threats

Impact important

References

8 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/s…	self
https://www.suse.com/support/update/announcement/…	self
https://www.suse.com/support/update/announcement/…	self
https://bugzilla.suse.com/1284985	self
https://www.suse.com/security/cve/CVE-2026-102554/	self
https://www.suse.com/security/cve/CVE-2026-102554	external
https://bugzilla.suse.com/1284985	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for guava",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for guava fixes the following issue:\n\n- CVE-2026-102554: Allocation of resources without limits or throttling (CWE-770) during Java object deserialization\n  allows an attacker to cause a Denial of Service via OutOfMemoryError (bsc#1284985).\n\nChanges for guava:\n\n- Adapt the generated OSGi data to reality\n- Upgrade to guava 33.7.2\n * Changes of 33.7.2\n + collect: Changed MapMaker, CompactHashMap, and CompactHashSet\n deserialization to avoid eagerly allocating as much memory as\n a serialization payload requests (bsc#1284985,\n CVE-2026-102554)\n * Changes of 33.7.1\n + removes the Multi-Release line from our jar manifest, fixing\n an issue under Java 9 and 10 that was introduced to guava-jre\n in version 33.7.0.\n * Changes of 33.7.0\n + Guava module-info.class is now present at the root of the jar\n instead of under a multi-release root. This prevents the jar\n from containing a file at META-INF/versions/9/OSGI-INF/\n /MANIFEST.MF, which occasionally causes trouble for some users\n + collect: Changed some ImmutableMap implementations to create a\n new, lightweight object on each call to view methods like\n keySet(), rather than creating and storing that object during\n the first call for reuse later. This is likely to slightly\n improve performance for some users, but it could lead to\n regressions in unusual cases, such as repeatedly calling\n asMultimap().inverse() on the same ImmutableMap instance.\n + net: Added HttpHeaders constant for on-prefetch-activation.\n + net: Added MediaType constants for application/yaml and\n application/x-pem-file.\n + util.concurrent: Fixed ExecutionSequencer queue stall when\n delegate executor throws RejectedExecutionException.\n * Changes of 33.6.0\n + Migrated some classes from finalize() to PhantomReference in\n preparation for the removal of finalization.\n + cache: Deprecated CacheBuilder APIs that use TimeUnit in favor\n of those that use Duration.\n + collect: Added toImmutableSortedMap collectors that use the\n natural comparator.\n + collect: Changed ConcurrentHashMultiset, ImmutableMultimap,\n and TreeMultiset deserialization to avoid mutating final\n fields. In extremely unlikely scenarios in which an instance\n of that type contains an object that refers back to that\n instance, this could lead to a broken instance that throws\n NullPointerException when used.\n + graph: Removed @Beta from all APIs in the package.\n + graph: Added support to Graphs.transitiveClosure() for\n different strategies for adding self-loops.\n + graph: Added an asNetwork() view to Graph and ValueGraph.\n + hash: Added BloomFilter.serializedSize().\n + net: Added HttpHeaders.CDN_CACHE_CONTROL.\n * Changes of 33.5.0\n + For users of guava-gwt: Google has moved off GWT internally.\n We plan to continue to release guava-gwt for users of GWT and\n J2CL, but the artifact is no longer tested for GWT-specific\n issues, and we have limited resources to fix any unexpected\n issues that might arise. While we do not anticipate any\n specific problems, we can\u0027t guarantee how long support will\n continue.\n + Listed the JSpecify annotations as an optional dependency in\n our OSGi metadata.\n + cache: Improved the handling of exceptions from compute\n functions in Cache.asMap(). (We do still recommend using\n Caffeine rather than com.google.common.cache.)\n + collect: Improved Iterators.mergeSorted() to preserve\n stability for equal elements.\n + math: Added saturatedAbs methods to IntMath and LongMath.\n + net: Added image/avif to MediaType.\n + util.concurrent: Added Striped.custom.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLES-16.0-1947",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_24263-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:24263-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202624263-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:24263-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202624263-1/"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1284985",
        "url": "https://bugzilla.suse.com/1284985"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-102554 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-102554/"
      }
    ],
    "title": "Security update for guava",
    "tracking": {
      "current_release_date": "2026-10-23T09:42:19Z",
      "generator": {
        "date": "2026-10-20T13:36:37Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:24263-1",
      "initial_release_date": "2026-10-20T13:36:37Z",
      "revision_history": [
        {
          "date": "2026-10-20T13:36:37Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-10-23T09:42:19Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "guava-0:33.7.2-160000.1.1.noarch",
                "product": {
                  "name": "guava-0:33.7.2-160000.1.1.noarch",
                  "product_id": "guava-0:33.7.2-160000.1.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:google:guava:33.7.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/guava@33.7.2-160000.1.1?arch=noarch\u0026upstream=guava-0:33.7.2-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "guava-javadoc-0:33.7.2-160000.1.1.noarch",
                "product": {
                  "name": "guava-javadoc-0:33.7.2-160000.1.1.noarch",
                  "product_id": "guava-javadoc-0:33.7.2-160000.1.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:google:guava:33.7.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/guava-javadoc@33.7.2-160000.1.1?arch=noarch\u0026upstream=guava-0:33.7.2-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "guava-testlib-0:33.7.2-160000.1.1.noarch",
                "product": {
                  "name": "guava-testlib-0:33.7.2-160000.1.1.noarch",
                  "product_id": "guava-testlib-0:33.7.2-160000.1.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:google:guava:33.7.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/guava-testlib@33.7.2-160000.1.1?arch=noarch\u0026upstream=guava-0:33.7.2-160000.1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 16.0",
                "product": {
                  "name": "SUSE Linux Enterprise Server 16.0",
                  "product_id": "SUSE Linux Enterprise Server 16.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:16:16.0:server"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP applications 16.0",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP applications 16.0",
                  "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:16:16.0:server-sap"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "guava-0:33.7.2-160000.1.1.noarch as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:guava-0:33.7.2-160000.1.1.noarch"
        },
        "product_reference": "guava-0:33.7.2-160000.1.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "guava-javadoc-0:33.7.2-160000.1.1.noarch as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:guava-javadoc-0:33.7.2-160000.1.1.noarch"
        },
        "product_reference": "guava-javadoc-0:33.7.2-160000.1.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "guava-testlib-0:33.7.2-160000.1.1.noarch as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:guava-testlib-0:33.7.2-160000.1.1.noarch"
        },
        "product_reference": "guava-testlib-0:33.7.2-160000.1.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "guava-0:33.7.2-160000.1.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:guava-0:33.7.2-160000.1.1.noarch"
        },
        "product_reference": "guava-0:33.7.2-160000.1.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "guava-javadoc-0:33.7.2-160000.1.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:guava-javadoc-0:33.7.2-160000.1.1.noarch"
        },
        "product_reference": "guava-javadoc-0:33.7.2-160000.1.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "guava-testlib-0:33.7.2-160000.1.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:guava-testlib-0:33.7.2-160000.1.1.noarch"
        },
        "product_reference": "guava-testlib-0:33.7.2-160000.1.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-102554",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-102554"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:guava-0:33.7.2-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:guava-javadoc-0:33.7.2-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:guava-testlib-0:33.7.2-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:guava-0:33.7.2-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:guava-javadoc-0:33.7.2-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:guava-testlib-0:33.7.2-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-102554",
          "url": "https://www.suse.com/security/cve/CVE-2026-102554"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1284985 for CVE-2026-102554",
          "url": "https://bugzilla.suse.com/1284985"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:guava-0:33.7.2-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:guava-javadoc-0:33.7.2-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:guava-testlib-0:33.7.2-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:guava-0:33.7.2-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:guava-javadoc-0:33.7.2-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:guava-testlib-0:33.7.2-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:guava-0:33.7.2-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:guava-javadoc-0:33.7.2-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:guava-testlib-0:33.7.2-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:guava-0:33.7.2-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:guava-javadoc-0:33.7.2-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:guava-testlib-0:33.7.2-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-20T13:36:37Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-102554"
    }
  ]
}

CVE-2026-102554 (GCVE-0-2026-102554)

Vulnerability from cvelistv5 – Published: 2026-10-09 15:07 – Updated: 2026-10-09 18:09

Title

Denial of Service via Eager Array Allocation During Deserialization in Guava

Summary

Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams.

Severity

8.2 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-09 18:09 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling
CWE-502 - Deserialization of Untrusted Data

Assigner

Google CNA under the Google root

CNA scorecard B 77/100 over 40 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/google/guava/security/advisori…
https://github.com/google/guava/commit/b931fe9d6d…
https://github.com/google/guava/releases/tag/v33.7.2

Impacted products

1 product

Vendor	Product	Version
Google	Guava	Affected: 4.0 , < 33.7.2 (semver)

Credits

Kaya Emre Arikan (https://github.com/kemrec)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-102554",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-09T18:09:30.467336Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-09T18:09:50.100Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/google/guava/security/advisories/GHSA-xxph-c9ww-hj94"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Guava",
          "repo": "https://github.com/google/guava",
          "vendor": "Google",
          "versions": [
            {
              "lessThan": "33.7.2",
              "status": "affected",
              "version": "4.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Kaya Emre Arikan (https://github.com/kemrec)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAllocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams.\u003c/p\u003e"
            }
          ],
          "value": "Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-130",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-130 Excessive Allocation"
            }
          ]
        },
        {
          "capecId": "CAPEC-586",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-586 Object Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-09T15:07:16.130Z",
        "orgId": "14ed7db2-1595-443d-9d34-6215bf890778",
        "shortName": "Google"
      },
      "references": [
        {
          "url": "https://github.com/google/guava/security/advisories/GHSA-xxph-c9ww-hj94"
        },
        {
          "url": "https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe"
        },
        {
          "url": "https://github.com/google/guava/releases/tag/v33.7.2"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Denial of Service via Eager Array Allocation During Deserialization in Guava"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778",
    "assignerShortName": "Google",
    "cveId": "CVE-2026-102554",
    "datePublished": "2026-10-09T15:07:16.130Z",
    "dateReserved": "2026-09-29T13:06:27.848Z",
    "dateUpdated": "2026-10-09T18:09:50.100Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted