{"id":"CVE-2026-102554","aliases":["AZL-106919","AZL-107988","DEBIAN-CVE-2026-102554","EUVD-2026-95889","GHSA-xxph-c9ww-hj94","RHLW-2026-688eb055fb69a082","RHLW-2026-beae96651cf48d01","ROOT-APP-MAVEN-CVE-2026-102554","SUSE-SU-2026:24263-1","SUSE-SU-2026:5061-1","UBUNTU-CVE-2026-102554","openSUSE-SU-2026:12109-1","openSUSE-SU-2026:22143-1"],"status":"published","title":"Denial of Service via Eager Array Allocation During Deserialization in Guava","description":"Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams.","severity":{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00352,"percentile":0.29279,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-502","CWE-770"],"published":"2026-10-09T15:07:16Z","modified":"2026-11-12T15:45:02Z","fixes":[{"ecosystem":"Maven","package":"com.google.guava:guava","fixed_in":["33.7.2"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:3","package":"guava","fixed_in":["33.0.0-2"],"sources":["osv"]},{"ecosystem":"Red Hat Lightwell:Maven","package":"com.google.guava:guava","fixed_in":["32.1.2.jre-rhlw-00001","32.0.1.jre-rhlw-00001"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"com.google.guava:guava","fixed_in":["33.4.8-jre-aikido.1","32.0.1-jre-aikido.1","33.4.0-jre-aikido.1","33.4.6-jre-aikido.1","33.6.0-jre-aikido.1","33.5.0-jre-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.com.google.guava:guava","fixed_in":["33.4.8-jre-root.io.1","32.0.1-jre-root.io.1","33.4.0-jre-root.io.1","33.4.6-jre-root.io.1","33.6.0-jre-root.io.1","33.5.0-jre-root.io.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"guava","fixed_in":["33.7.2-160000.1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"guava","fixed_in":["33.7.2-160000.1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"guava","fixed_in":["33.7.2-150200.3.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"j2objc-annotations","fixed_in":["3.0.0-150200.5.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"jspecify","fixed_in":["1.0.0-150200.5.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"guava","fixed_in":["33.7.2-150200.3.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"j2objc-annotations","fixed_in":["3.0.0-150200.5.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"jspecify","fixed_in":["1.0.0-150200.5.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"guava","fixed_in":["33.7.2-150200.3.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"j2objc-annotations","fixed_in":["3.0.0-150200.5.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"jspecify","fixed_in":["1.0.0-150200.5.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"guava","fixed_in":["33.7.2-150200.3.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"j2objc-annotations","fixed_in":["3.0.0-150200.5.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"jspecify","fixed_in":["1.0.0-150200.5.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"guava","fixed_in":["33.7.2-150200.3.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"j2objc-annotations","fixed_in":["3.0.0-150200.5.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"jspecify","fixed_in":["1.0.0-150200.5.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"guava","fixed_in":["33.7.2-150200.3.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"j2objc-annotations","fixed_in":["3.0.0-150200.5.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"jspecify","fixed_in":["1.0.0-150200.5.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"guava","fixed_in":["33.7.2-150200.3.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"j2objc-annotations","fixed_in":["3.0.0-150200.5.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"jspecify","fixed_in":["1.0.0-150200.5.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"guava","fixed_in":["33.7.2-150200.3.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"j2objc-annotations","fixed_in":["3.0.0-150200.5.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"jspecify","fixed_in":["1.0.0-150200.5.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"guava","fixed_in":["33.7.2-150200.3.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"j2objc-annotations","fixed_in":["3.0.0-150200.5.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"jspecify","fixed_in":["1.0.0-150200.5.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"guava","fixed_in":["33.7.2-150200.3.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"j2objc-annotations","fixed_in":["3.0.0-150200.5.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"jspecify","fixed_in":["1.0.0-150200.5.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"guava","fixed_in":["33.7.2-150200.3.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"j2objc-annotations","fixed_in":["3.0.0-150200.5.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"jspecify","fixed_in":["1.0.0-150200.5.5.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"guava","fixed_in":["33.7.2-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"guava","fixed_in":["33.7.2-160000.1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.google.guava:guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0"},{"last_affected":"33.7.1"},{"fixed":"33.7.2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"33.0.0-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"javapackages-bootstrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.14.0-5"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"guava-libraries","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["31.1-1","32.0.1-1","33.7.1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"guava-libraries","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["32.0.1-1","33.7.1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"guava-libraries","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["32.0.1-1","33.7.1-1"]},{"source":"osv","ecosystem":"Maven","package":"com.google.guava:guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0"},{"fixed":"33.7.2"}]}],"versions":["10.0","10.0-rc1","10.0-rc2","10.0-rc3","10.0.1","11.0","11.0-rc1","11.0.1","11.0.2","12.0","12.0-rc1","12.0-rc2","12.0.1","13.0","13.0-rc1","13.0-rc2","13.0.1","14.0","14.0-rc1","14.0-rc2","14.0-rc3","14.0.1","15.0","15.0-rc1","16.0","16.0-rc1","16.0.1","17.0","17.0-rc1","17.0-rc2","18.0","18.0-rc1","18.0-rc2","19.0","19.0-rc1","19.0-rc2","19.0-rc3","20.0","20.0-rc1","21.0","21.0-rc1","21.0-rc2","22.0","22.0-android","22.0-rc1","22.0-rc1-android","23.0","23.0-android","23.0-rc1","23.0-rc1-android","23.1-android","23.1-jre","23.2-android","23.2-jre","23.3-android","23.3-jre","23.4-android","23.4-jre","23.5-android","23.5-jre","23.6-android","23.6-jre","23.6.1-android","23.6.1-jre","24.0-android","24.0-jre","24.1-android","24.1-jre","24.1.1-android","24.1.1-jre","25.0-android","25.0-jre","25.1-android","25.1-jre","26.0-android","26.0-jre","27.0-android","27.0-jre","27.0.1-android","27.0.1-jre","27.1-android","27.1-jre","28.0-android","28.0-jre","28.1-android","28.1-jre","28.2-android","28.2-jre","29.0-android","29.0-jre","30.0-android","30.0-jre","30.1-android","30.1-jre","30.1.1-android","30.1.1-jre","31.0-android","31.0-jre","31.0.1-android","31.0.1-jre","31.1-android","31.1-jre","32.0.0-android","32.0.0-jre","32.0.1-android","32.0.1-jre","32.1.0-android","32.1.0-jre","32.1.1-android","32.1.1-jre","32.1.2-android","32.1.2-jre","32.1.3-android","32.1.3-jre","33.0.0-android","33.0.0-jre","33.1.0-android","33.1.0-jre","33.2.0-android","33.2.0-jre","33.2.1-android","33.2.1-jre","33.3.0-android","33.3.0-jre","33.3.1-android","33.3.1-jre","33.4.0-android","33.4.0-jre","33.4.1-android","33.4.1-jre","33.4.2-android","33.4.2-jre","33.4.3-android","33.4.3-jre","33.4.4-android","33.4.4-jre","33.4.5-android","33.4.5-jre","33.4.6-android","33.4.6-jre","33.4.7-android","33.4.7-jre","33.4.8-android","33.4.8-jre","33.5.0-android","33.5.0-jre","33.6.0-android","33.6.0-jre","33.7.0-android","33.7.0-jre","33.7.1-android","33.7.1-jre"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"com.google.guava:guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32.1.2.jre-rhlw-00001"}]}],"versions":["10.0","10.0-rc1","10.0-rc2","10.0-rc3","10.0.1","11.0","11.0-rc1","11.0.1","11.0.2","12.0","12.0-rc1","12.0-rc2","12.0.1","13.0","13.0-rc1","13.0-rc2","13.0.1","14.0","14.0-rc1","14.0-rc2","14.0-rc3","14.0.1","15.0","15.0-rc1","16.0","16.0-rc1","16.0.1","17.0","17.0-rc1","17.0-rc2","18.0","18.0-rc1","18.0-rc2","19.0","19.0-rc1","19.0-rc2","19.0-rc3","20.0","20.0-rc1","21.0","21.0-rc1","21.0-rc2","22.0","22.0-android","22.0-rc1","22.0-rc1-android","23.0","23.0-android","23.0-rc1","23.0-rc1-android","23.1-android","23.1-jre","23.2-android","23.2-jre","23.3-android","23.3-jre","23.4-android","23.4-jre","23.5-android","23.5-jre","23.6-android","23.6-jre","23.6.1-android","23.6.1-jre","24.0-android","24.0-jre","24.1-android","24.1-jre","24.1.1-android","24.1.1-jre","25.0-android","25.0-jre","25.1-android","25.1-jre","26.0-android","26.0-jre","27.0-android","27.0-jre","27.0.1-android","27.0.1-jre","27.1-android","27.1-jre","28.0-android","28.0-jre","28.1-android","28.1-jre","28.2-android","28.2-jre","29.0-android","29.0-jre","30.0-android","30.0-jre","30.1-android","30.1-jre","30.1.1-android","30.1.1-jre","31.0-android","31.0-jre","31.0.1-android","31.0.1-jre","31.1-android","31.1-jre","32.0.0-android","32.0.0-jre","32.0.1-android","32.0.1-jre","32.1.0-android","32.1.0-jre","32.1.1-android","32.1.1-jre","32.1.2.jre","r03","r05","r06","r07","r08","r09"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"com.google.guava:guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32.0.1.jre-rhlw-00001"}]}],"versions":["10.0","10.0-rc1","10.0-rc2","10.0-rc3","10.0.1","11.0","11.0-rc1","11.0.1","11.0.2","12.0","12.0-rc1","12.0-rc2","12.0.1","13.0","13.0-rc1","13.0-rc2","13.0.1","14.0","14.0-rc1","14.0-rc2","14.0-rc3","14.0.1","15.0","15.0-rc1","16.0","16.0-rc1","16.0.1","17.0","17.0-rc1","17.0-rc2","18.0","18.0-rc1","18.0-rc2","19.0","19.0-rc1","19.0-rc2","19.0-rc3","20.0","20.0-rc1","21.0","21.0-rc1","21.0-rc2","22.0","22.0-android","22.0-rc1","22.0-rc1-android","23.0","23.0-android","23.0-rc1","23.0-rc1-android","23.1-android","23.1-jre","23.2-android","23.2-jre","23.3-android","23.3-jre","23.4-android","23.4-jre","23.5-android","23.5-jre","23.6-android","23.6-jre","23.6.1-android","23.6.1-jre","24.0-android","24.0-jre","24.1-android","24.1-jre","24.1.1-android","24.1.1-jre","25.0-android","25.0-jre","25.1-android","25.1-jre","26.0-android","26.0-jre","27.0-android","27.0-jre","27.0.1-android","27.0.1-jre","27.1-android","27.1-jre","28.0-android","28.0-jre","28.1-android","28.1-jre","28.2-android","28.2-jre","29.0-android","29.0-jre","30.0-android","30.0-jre","30.1-android","30.1-jre","30.1.1-android","30.1.1-jre","31.0-android","31.0-jre","31.0.1-android","31.0.1-jre","31.1-android","31.1-jre","32.0.0-android","32.0.0-jre","32.0.1.jre","r03","r05","r06","r07","r08","r09"]},{"source":"osv","ecosystem":"Root:Maven","package":"com.google.guava:guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"33.4.8-jre-aikido.1"},{"fixed":"32.0.1-jre-aikido.1"},{"fixed":"33.4.0-jre-aikido.1"},{"fixed":"33.4.6-jre-aikido.1"},{"fixed":"33.6.0-jre-aikido.1"},{"fixed":"33.5.0-jre-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.com.google.guava:guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"33.4.8-jre-root.io.1"},{"fixed":"32.0.1-jre-root.io.1"},{"fixed":"33.4.0-jre-root.io.1"},{"fixed":"33.4.6-jre-root.io.1"},{"fixed":"33.6.0-jre-root.io.1"},{"fixed":"33.5.0-jre-root.io.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"33.7.2-160000.1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"33.7.2-160000.1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"33.7.2-150200.3.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"j2objc-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.5.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"jspecify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-150200.5.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"33.7.2-150200.3.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"j2objc-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.5.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"jspecify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-150200.5.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"33.7.2-150200.3.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"j2objc-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.5.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"jspecify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-150200.5.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"33.7.2-150200.3.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"j2objc-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.5.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"jspecify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-150200.5.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"33.7.2-150200.3.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"j2objc-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.5.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"jspecify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-150200.5.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"33.7.2-150200.3.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"j2objc-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.5.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"jspecify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-150200.5.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"33.7.2-150200.3.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"j2objc-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.5.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"jspecify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-150200.5.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"33.7.2-150200.3.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"j2objc-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.5.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"jspecify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-150200.5.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"33.7.2-150200.3.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"j2objc-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.5.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"jspecify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-150200.5.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"33.7.2-150200.3.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"j2objc-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.5.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"jspecify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-150200.5.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"33.7.2-150200.3.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"j2objc-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.5.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"jspecify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-150200.5.5.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"guava-libraries","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["14.0.1-1","15.0-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"guava-libraries","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["18.0-4ubuntu1","19.0-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"guava-libraries","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["19.0-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"guava-libraries","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["19.0-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"guava-libraries","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["29.0-6"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"guava-libraries","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["32.0.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"guava-libraries","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["32.0.1-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"guava-libraries","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["32.0.1-1","32.0.1-1build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"33.7.2-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"33.7.2-160000.1.1"}]}]}],"products":[{"vendor":"google","product":"guava"}],"references":[{"url":"https://github.com/google/guava/security/advisories/GHSA-xxph-c9ww-hj94","tags":["exploit","advisory","web"]},{"url":"https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe","tags":["fix","web"]},{"url":"https://github.com/google/guava/releases/tag/v33.7.2","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102554","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-xxph-c9ww-hj94","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102554.json","tags":["advisory"]},{"url":"https://github.com/google/guava","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-102554","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624263-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1284985","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102554","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265061-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-102554","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-102554","tags":["report"]},{"url":"github.com/google/guava","tags":["report"]},{"url":"github.com/google/guava/commit/a0d0c36432c4cc7aa4b5063bab9f20d3d18fe9fc","tags":["report"]},{"url":"github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe","tags":["report"]},{"url":"github.com/google/guava/security/advisories/ghsa-xxph-c9ww-hj94","tags":["report"]},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1150495","tags":["report"]},{"url":"security-tracker.debian.org/tracker/cve-2026-102554","tags":["report"]},{"url":"github.com/cveproject/cvelistv5/tree/main/cves/2026/102xxx/cve-2026-102554.json","tags":["report"]},{"url":"github.com/google/guava/releases/tag/v33.7.2","tags":["report"]},{"url":"nvd.nist.gov/vuln/detail/cve-2026-102554","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-102554","title":"Denial of Service via Eager Array Allocation During Deserialization in Guava","description":"Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams.","status":"published","published":"2026-10-09T15:07:16.13Z","modified":"2026-10-09T18:09:50.1Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-770","CWE-502"],"updated_at":"2026-11-02T13:38:43.260938Z"}],"euvd":[{"id":"EUVD-2026-95889","description":"Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams.","status":"published","published":"2026-10-09T15:07:16Z","modified":"2026-10-09T18:09:50Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:27:24.64208Z"}],"ghsa":[{"id":"GHSA-xxph-c9ww-hj94","title":"Google Guava: CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocation","description":"# CompactHashMap/CompactHashSet/MapMakerInternalMap native deserialization triggers uncontrolled memory allocation\n\n## Summary\n\n`CompactHashMap`, `CompactHashSet`, and `MapMakerInternalMap` implement `readObject(ObjectInputStream)` by reading an attacker-controlled `elementCount` or `initialCapacity` from the stream. On the very first insertion during or after deserialization (for the `CompactHash*` collections, inside `allocArrays()`) or immediately during deserialization (for `MapMakerInternalMap`), the implementation eagerly allocates arrays sized to that full, unvalidated value (up to `CompactHashing.MAX_SIZE` = 2^30-1, ~1.07 billion, for example) before the rest of the stream's actual content has been consumed. A 72-byte malicious serialized stream containing a single tiny element can force a multi-gigabyte allocation and crash a JVM with `OutOfMemoryError`, dynamically confirmed against the current release.\n\n## Details\n\n`CompactHashMap.readObject()` (`guava/src/com/google/common/collect/CompactHashMap.java`):\n\n```java\nprivate void readObject(ObjectInputStream stream) throws IOException, ClassNotFoundException {\n  stream.defaultReadObject();\n  int elementCount = stream.readInt();\n  if (elementCount \u003c 0) {\n    throw new InvalidObjectException(\"Invalid size: \" + elementCount);\n  }\n  init(elementCount);\n  for (int i = 0; i \u003c elementCount; i++) {\n    K key = (K) stream.readObject();\n    V value = (V) stream.readObject();\n    put(key, value);\n  }\n}\n```\n\n`elementCount` is only checked for being non-negative; there is no upper bound and no relationship enforced between the declared count and how much data actually follows in the stream. `init(elementCount)` (line 251) just stores the value (clamped to `[1, CompactHashing.MAX_SIZE]`, i.e. up to 2^30-1):\n\n```java\nvoid init(int expectedSize) {\n  Preconditions.checkArgument(expectedSize \u003e= 0, \"Expected size must be \u003e= 0\");\n  this.metadata = Ints.constrainToRange(expectedSize, 1, CompactHashing.MAX_SIZE);\n}\n```\n\nThe real allocation is deferred to `allocArrays()`, which fires lazily on the *first* `put()` call — i.e. after only one key/value pair has actually been read off the wire:\n\n```java\nint allocArrays() {\n  ...\n  int expectedSize = metadata;\n  int buckets = CompactHashing.tableSize(expectedSize);\n  this.table = CompactHashing.createTable(buckets);\n  setHashTableMask(buckets - 1);\n  this.entries = new int[expectedSize];\n  this.keys = new Object[expectedSize];\n  this.values = new Object[expectedSize];\n  return expectedSize;\n}\n```\n\nWith `expectedSize` near `CompactHashing.MAX_SIZE` (2^30-1), this single call allocates a hash `table` plus three `expectedSize`-length arrays — multiple gigabytes — triggered by a stream that has, at that point, only supplied one small real element. `CompactHashSet.readObject()`/`allocArrays()` have the identical shape. `CompactLinkedHashMap`/`CompactLinkedHashSet` extend these classes and inherit the same unguarded path.\n\nThe problem with `MapMakerInternalMap` is similar, with [a size read from the serialized data and stored in a `MapMaker` instance](https://github.com/google/guava/blob/1278ad9c2257f48dc82fb7b7c625ab563605aa24/guava/src/com/google/common/collect/MapMakerInternalMap.java#L2848-L2851) for [later user during deserialization](https://github.com/google/guava/blob/1278ad9c2257f48dc82fb7b7c625ab563605aa24/guava/src/com/google/common/collect/MapMakerInternalMap.java#L2897), when [the `MapMaker` is passed back to `MapMakerInternalMap`](https://github.com/google/guava/blob/1278ad9c2257f48dc82fb7b7c625ab563605aa24/guava/src/com/google/common/collect/MapMaker.java#L287) and [segments are allocated](https://github.com/google/guava/blob/1278ad9c2257f48dc82fb7b7c625ab563605aa24/guava/src/com/google/common/collect/MapMakerInternalMap.java#L173-L200) by [calling `newSegment`](https://github.com/google/guava/blob/1278ad9c2257f48dc82fb7b7c625ab563605aa24/guava/src/com/google/common/collect/MapMakerInternalMap.java#L1143), whose implementations ([example](https://github.com/google/guava/blob/1278ad9c2257f48dc82fb7b7c625ab563605aa24/guava/src/com/google/common/collect/MapMakerInternalMap.java#L443)) create `Segment` instances ([example](https://github.com/google/guava/blob/1278ad9c2257f48dc82fb7b7c625ab563605aa24/guava/src/com/google/common/collect/MapMakerInternalMap.java#L2019)) that [allocate arrays of the requested capacity](https://github.com/google/guava/blob/1278ad9c2257f48dc82fb7b7c625ab563605aa24/guava/src/com/google/common/collect/MapMakerInternalMap.java#L1234) through [the `newTable`](https://github.com/google/guava/blob/1278ad9c2257f48dc82fb7b7c625ab563605aa24/guava/src/com/google/common/collect/MapMakerInternalMap.java#L1262) helper.\n\nThis is the same amplification shape as the already-fixed **CVE-2018-10237** (`AtomicDoubleArray`/`CompoundOrdering`: attacker declares a large size, library eagerly allocates before validating against actual stream content). That fix rewrote `AtomicDoubleArray.readObject()` to grow an `ImmutableLongArray.Builder` incrementally per element actually read, rather than pre-allocating from the declared size — Guava's own `HashBiMap.readObject()` documents the same defensive principle explicitly in a comment: `init(16); // resist hostile attempts to allocate gratuitous heap`. `CompactHashMap`/`CompactHashSet` do not follow either of these two patterns already present elsewhere in the same codebase.\n\n**Reachability**: All classes are top-level, `implements ... Serializable`, and require no special classpath setup beyond Guava being present (near-ubiquitous on JVM backends). A native Java deserialization attacker names the class directly in a hand-crafted stream — no particular Guava factory method needs to have been used by the victim application, exactly as with the precedent CVE.\n\n## PoC\n\nFull source and run instructions in the attached `poc-guava-compacthash-dos.zip` (Maven project, `guava:33.7.1-jre` — the current latest release — as the only dependency). The PoC:\n\n1. Uses reflection only to legitimately obtain a `CompactHashSet` instance (it is package-private; a real attacker does not need this step, since they craft the serialized bytes directly rather than calling Guava's own serialization code).\n2. Serializes one set with 1 element and one with 2 elements, diffs the two byte streams to locate the exact offset of the `elementCount` field (byte-precise, not guessed).\n3. Patches that one 4-byte field in the 1-element stream from `1` to `0x3FFFFFFF` (`CompactHashing.MAX_SIZE`), leaving the rest of the 72-byte stream (one real `\"A\"` element) untouched.\n4. Feeds the resulting 72-byte malicious stream into a plain `new ObjectInputStream(...).readObject()` call against the real, unmodified `guava-33.7.1-jre.jar`.\n\nActual run output:\n\n```\n### -Xmx8g (generous heap) ###\nLocated size field at offset 63, value=1 (expected 1)\nMalicious stream size: 72 bytes\nDeclared elementCount: 1073741823 (~1.07 billion)\nReal payload: 1 tiny string element (\"A\")\n=== RESULT ===\nException: java.lang.OutOfMemoryError: Java heap space\nTime to allocate+fail: 4013 ms\nHeap used before: 3 MB\nHeap used after (at failure point): 4103 MB\nJVM max heap (-Xmx): 8192 MB\n\n### -Xmx128m (ordinary service-sized heap) ###\nLocated size field at offset 63, value=1 (expected 1)\nMalicious stream size: 72 bytes\nDeclared elementCount: 1073741823 (~1.07 billion)\nReal payload: 1 tiny string element (\"A\")\n=== RESULT ===\nException: java.lang.OutOfMemoryError: Java heap space\nTime to allocate+fail: 24 ms\nHeap used before: 4 MB\nHeap used after (at failure point): 2 MB\nJVM max heap (-Xmx): 128 MB\n```\n\nA 72-byte input forces ~4.1 GB of real allocation before failing on an 8 GB heap, and crashes a 128 MB heap in 24 ms — over 50,000x amplification between input size and forced allocation.\n\nTo reproduce: `mvn -q compile dependency:build-classpath -Dmdep.outputFile=cp.txt \u0026\u0026 java -Xmx128m -cp \"target/classes:$(cat cp.txt)\" poc.Poc`\n\n## Impact\n\nUncontrolled resource consumption (CWE-770 / CWE-400) via native Java deserialization: any application that runs `ObjectInputStream.readObject()` on data reachable by an attacker, and has Guava on its classpath (true for a large fraction of the JVM ecosystem), can be crashed with a single ~72-byte payload, regardless of what type the application itself expected to deserialize.\n\n## Severity\n\nCVSS 3.1: `AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H` — identical vector to CVE-2018-10237, the precedent this is a sibling of. Recomputed with the full formula: exploitability = 8.22×0.85×0.44×0.85×0.85 = 2.221; ISS = 1-(1×1×0.44) = 0.56; impact = 6.42×0.56 = 3.595; base = roundup(5.816) = **5.9 (Medium)**.\n\n## Affected\n\n`com.google.guava:guava`, all editions (`-jre`/`-android`) — confirmed on the current latest release, 33.7.1-jre. `CompactHashMap`/`CompactHashSet`/`CompactLinkedHashMap`/`CompactLinkedHashSet` have had this same `readObject`/`allocArrays` shape for a long time (probably since they were added in Guava 23.6), and similarly for `MapMakerInternalMap` (which was introduced in Guava 4.0); not tested against older individual releases.\n\n## Suggested fix\n\nApply the same defense already used elsewhere in this codebase: either clamp the initial `init()` capacity to a small constant regardless of the declared `elementCount` (as `HashBiMap.readObject()` already does — `init(16); // resist hostile attempts to allocate gratuitous heap`) and grow incrementally as elements are actually read, or grow the backing arrays incrementally per iteration of the deserialization loop (as the fixed `AtomicDoubleArray.readObject()` does via `ImmutableLongArray.Builder`) instead of eagerly sizing to the full attacker-declared count on first insert.","status":"published","published":"2026-10-27T14:27:53Z","modified":"2026-10-27T14:27:55Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400","CWE-502","CWE-770"],"updated_at":"2026-11-02T14:41:36.858527Z"}],"nvd":[{"id":"CVE-2026-102554","description":"Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams.","status":"published","published":"2026-10-09T16:17:20.41Z","modified":"2026-10-09T18:17:01.38Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-502","CWE-770"],"updated_at":"2026-11-02T14:12:55.473789Z"}],"osv":[{"id":"CVE-2026-102554","title":"Denial of Service via Eager Array Allocation During Deserialization in Guava","description":"Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams.","status":"published","published":"2026-10-09T15:07:16.13Z","modified":"2026-11-05T13:11:11.01859395Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-502","CWE-770"],"updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"DEBIAN-CVE-2026-102554","description":"Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams.","status":"published","published":"2026-10-09T16:17:20.41Z","modified":"2026-10-10T10:00:09.225757897Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:45:48.903138Z"},{"id":"GHSA-xxph-c9ww-hj94","title":"Google Guava: CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocation","description":"# CompactHashMap/CompactHashSet/MapMakerInternalMap native deserialization triggers uncontrolled memory allocation\n\n## Summary\n\n`CompactHashMap`, `CompactHashSet`, and `MapMakerInternalMap` implement `readObject(ObjectInputStream)` by reading an attacker-controlled `elementCount` or `initialCapacity` from the stream. On the very first insertion during or after deserialization (for the `CompactHash*` collections, inside `allocArrays()`) or immediately during deserialization (for `MapMakerInternalMap`), the implementation eagerly allocates arrays sized to that full, unvalidated value (up to `CompactHashing.MAX_SIZE` = 2^30-1, ~1.07 billion, for example) before the rest of the stream's actual content has been consumed. A 72-byte malicious serialized stream containing a single tiny element can force a multi-gigabyte allocation and crash a JVM with `OutOfMemoryError`, dynamically confirmed against the current release.\n\n## Details\n\n`CompactHashMap.readObject()` (`guava/src/com/google/common/collect/CompactHashMap.java`):\n\n```java\nprivate void readObject(ObjectInputStream stream) throws IOException, ClassNotFoundException {\n  stream.defaultReadObject();\n  int elementCount = stream.readInt();\n  if (elementCount \u003c 0) {\n    throw new InvalidObjectException(\"Invalid size: \" + elementCount);\n  }\n  init(elementCount);\n  for (int i = 0; i \u003c elementCount; i++) {\n    K key = (K) stream.readObject();\n    V value = (V) stream.readObject();\n    put(key, value);\n  }\n}\n```\n\n`elementCount` is only checked for being non-negative; there is no upper bound and no relationship enforced between the declared count and how much data actually follows in the stream. `init(elementCount)` (line 251) just stores the value (clamped to `[1, CompactHashing.MAX_SIZE]`, i.e. up to 2^30-1):\n\n```java\nvoid init(int expectedSize) {\n  Preconditions.checkArgument(expectedSize \u003e= 0, \"Expected size must be \u003e= 0\");\n  this.metadata = Ints.constrainToRange(expectedSize, 1, CompactHashing.MAX_SIZE);\n}\n```\n\nThe real allocation is deferred to `allocArrays()`, which fires lazily on the *first* `put()` call — i.e. after only one key/value pair has actually been read off the wire:\n\n```java\nint allocArrays() {\n  ...\n  int expectedSize = metadata;\n  int buckets = CompactHashing.tableSize(expectedSize);\n  this.table = CompactHashing.createTable(buckets);\n  setHashTableMask(buckets - 1);\n  this.entries = new int[expectedSize];\n  this.keys = new Object[expectedSize];\n  this.values = new Object[expectedSize];\n  return expectedSize;\n}\n```\n\nWith `expectedSize` near `CompactHashing.MAX_SIZE` (2^30-1), this single call allocates a hash `table` plus three `expectedSize`-length arrays — multiple gigabytes — triggered by a stream that has, at that point, only supplied one small real element. `CompactHashSet.readObject()`/`allocArrays()` have the identical shape. `CompactLinkedHashMap`/`CompactLinkedHashSet` extend these classes and inherit the same unguarded path.\n\nThe problem with `MapMakerInternalMap` is similar, with [a size read from the serialized data and stored in a `MapMaker` instance](https://github.com/google/guava/blob/1278ad9c2257f48dc82fb7b7c625ab563605aa24/guava/src/com/google/common/collect/MapMakerInternalMap.java#L2848-L2851) for [later user during deserialization](https://github.com/google/guava/blob/1278ad9c2257f48dc82fb7b7c625ab563605aa24/guava/src/com/google/common/collect/MapMakerInternalMap.java#L2897), when [the `MapMaker` is passed back to `MapMakerInternalMap`](https://github.com/google/guava/blob/1278ad9c2257f48dc82fb7b7c625ab563605aa24/guava/src/com/google/common/collect/MapMaker.java#L287) and [segments are allocated](https://github.com/google/guava/blob/1278ad9c2257f48dc82fb7b7c625ab563605aa24/guava/src/com/google/common/collect/MapMakerInternalMap.java#L173-L200) by [calling `newSegment`](https://github.com/google/guava/blob/1278ad9c2257f48dc82fb7b7c625ab563605aa24/guava/src/com/google/common/collect/MapMakerInternalMap.java#L1143), whose implementations ([example](https://github.com/google/guava/blob/1278ad9c2257f48dc82fb7b7c625ab563605aa24/guava/src/com/google/common/collect/MapMakerInternalMap.java#L443)) create `Segment` instances ([example](https://github.com/google/guava/blob/1278ad9c2257f48dc82fb7b7c625ab563605aa24/guava/src/com/google/common/collect/MapMakerInternalMap.java#L2019)) that [allocate arrays of the requested capacity](https://github.com/google/guava/blob/1278ad9c2257f48dc82fb7b7c625ab563605aa24/guava/src/com/google/common/collect/MapMakerInternalMap.java#L1234) through [the `newTable`](https://github.com/google/guava/blob/1278ad9c2257f48dc82fb7b7c625ab563605aa24/guava/src/com/google/common/collect/MapMakerInternalMap.java#L1262) helper.\n\nThis is the same amplification shape as the already-fixed **CVE-2018-10237** (`AtomicDoubleArray`/`CompoundOrdering`: attacker declares a large size, library eagerly allocates before validating against actual stream content). That fix rewrote `AtomicDoubleArray.readObject()` to grow an `ImmutableLongArray.Builder` incrementally per element actually read, rather than pre-allocating from the declared size — Guava's own `HashBiMap.readObject()` documents the same defensive principle explicitly in a comment: `init(16); // resist hostile attempts to allocate gratuitous heap`. `CompactHashMap`/`CompactHashSet` do not follow either of these two patterns already present elsewhere in the same codebase.\n\n**Reachability**: All classes are top-level, `implements ... Serializable`, and require no special classpath setup beyond Guava being present (near-ubiquitous on JVM backends). A native Java deserialization attacker names the class directly in a hand-crafted stream — no particular Guava factory method needs to have been used by the victim application, exactly as with the precedent CVE.\n\n## PoC\n\nFull source and run instructions in the attached `poc-guava-compacthash-dos.zip` (Maven project, `guava:33.7.1-jre` — the current latest release — as the only dependency). The PoC:\n\n1. Uses reflection only to legitimately obtain a `CompactHashSet` instance (it is package-private; a real attacker does not need this step, since they craft the serialized bytes directly rather than calling Guava's own serialization code).\n2. Serializes one set with 1 element and one with 2 elements, diffs the two byte streams to locate the exact offset of the `elementCount` field (byte-precise, not guessed).\n3. Patches that one 4-byte field in the 1-element stream from `1` to `0x3FFFFFFF` (`CompactHashing.MAX_SIZE`), leaving the rest of the 72-byte stream (one real `\"A\"` element) untouched.\n4. Feeds the resulting 72-byte malicious stream into a plain `new ObjectInputStream(...).readObject()` call against the real, unmodified `guava-33.7.1-jre.jar`.\n\nActual run output:\n\n```\n### -Xmx8g (generous heap) ###\nLocated size field at offset 63, value=1 (expected 1)\nMalicious stream size: 72 bytes\nDeclared elementCount: 1073741823 (~1.07 billion)\nReal payload: 1 tiny string element (\"A\")\n=== RESULT ===\nException: java.lang.OutOfMemoryError: Java heap space\nTime to allocate+fail: 4013 ms\nHeap used before: 3 MB\nHeap used after (at failure point): 4103 MB\nJVM max heap (-Xmx): 8192 MB\n\n### -Xmx128m (ordinary service-sized heap) ###\nLocated size field at offset 63, value=1 (expected 1)\nMalicious stream size: 72 bytes\nDeclared elementCount: 1073741823 (~1.07 billion)\nReal payload: 1 tiny string element (\"A\")\n=== RESULT ===\nException: java.lang.OutOfMemoryError: Java heap space\nTime to allocate+fail: 24 ms\nHeap used before: 4 MB\nHeap used after (at failure point): 2 MB\nJVM max heap (-Xmx): 128 MB\n```\n\nA 72-byte input forces ~4.1 GB of real allocation before failing on an 8 GB heap, and crashes a 128 MB heap in 24 ms — over 50,000x amplification between input size and forced allocation.\n\nTo reproduce: `mvn -q compile dependency:build-classpath -Dmdep.outputFile=cp.txt \u0026\u0026 java -Xmx128m -cp \"target/classes:$(cat cp.txt)\" poc.Poc`\n\n## Impact\n\nUncontrolled resource consumption (CWE-770 / CWE-400) via native Java deserialization: any application that runs `ObjectInputStream.readObject()` on data reachable by an attacker, and has Guava on its classpath (true for a large fraction of the JVM ecosystem), can be crashed with a single ~72-byte payload, regardless of what type the application itself expected to deserialize.\n\n## Severity\n\nCVSS 3.1: `AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H` — identical vector to CVE-2018-10237, the precedent this is a sibling of. Recomputed with the full formula: exploitability = 8.22×0.85×0.44×0.85×0.85 = 2.221; ISS = 1-(1×1×0.44) = 0.56; impact = 6.42×0.56 = 3.595; base = roundup(5.816) = **5.9 (Medium)**.\n\n## Affected\n\n`com.google.guava:guava`, all editions (`-jre`/`-android`) — confirmed on the current latest release, 33.7.1-jre. `CompactHashMap`/`CompactHashSet`/`CompactLinkedHashMap`/`CompactLinkedHashSet` have had this same `readObject`/`allocArrays` shape for a long time (probably since they were added in Guava 23.6), and similarly for `MapMakerInternalMap` (which was introduced in Guava 4.0); not tested against older individual releases.\n\n## Suggested fix\n\nApply the same defense already used elsewhere in this codebase: either clamp the initial `init()` capacity to a small constant regardless of the declared `elementCount` (as `HashBiMap.readObject()` already does — `init(16); // resist hostile attempts to allocate gratuitous heap`) and grow incrementally as elements are actually read, or grow the backing arrays incrementally per iteration of the deserialization loop (as the fixed `AtomicDoubleArray.readObject()` does via `ImmutableLongArray.Builder`) instead of eagerly sizing to the full attacker-declared count on first insert.","status":"published","published":"2026-10-27T14:27:53Z","modified":"2026-10-27T14:45:04.803511466Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-400","CWE-502","CWE-770"],"updated_at":"2026-11-02T15:47:00.604718Z"},{"id":"RHLW-2026-688eb055fb69a082","title":"Lightwell Security Advisory: guava 32.1.2.jre-rhlw-00001","description":"Red Hat Lightwell has released com.google.guava:guava 32.1.2.jre-rhlw-00001 with a backported security fix.\n\nCVE-2026-102554: Denial of Service via Eager Array Allocation During Deserialization in Guava\n\nThis patched artifact is a drop-in replacement for com.google.guava:guava 32.1.2.jre from Maven Central.","status":"published","published":"2026-11-12T01:37:03Z","modified":"2026-11-12T08:45:02.558936812Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-12T09:14:11.67674Z"},{"id":"RHLW-2026-beae96651cf48d01","title":"Lightwell Security Advisory: guava 32.0.1.jre-rhlw-00001","description":"Red Hat Lightwell has released com.google.guava:guava 32.0.1.jre-rhlw-00001 with a backported security fix.\n\nCVE-2026-102554: Denial of Service via Eager Array Allocation During Deserialization in Guava\n\nThis patched artifact is a drop-in replacement for com.google.guava:guava 32.0.1.jre from Maven Central.","status":"published","published":"2026-11-12T05:43:15Z","modified":"2026-11-12T15:45:02.357185654Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-12T15:54:08.394971Z"},{"id":"ROOT-APP-MAVEN-CVE-2026-102554","title":"CVE-2026-102554 in com.google.guava:guava - Patched by Root","description":"Root has patched CVE-2026-102554 in the com.google.guava:guava package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-11-05T09:41:29Z","modified":"2026-11-05T10:15:03.26060164Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-05T13:30:49.23793Z"},{"id":"UBUNTU-CVE-2026-102554","description":"Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams.","status":"published","published":"2026-10-09T16:17:00Z","modified":"2026-10-17T12:59:45.168430707Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:55:58.519486Z"},{"id":"AZL-106919","title":"CVE-2026-102554 affecting package guava for versions less than 33.0.0-2","description":"Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams.","status":"published","published":"2026-10-09T16:17:20Z","modified":"2026-11-07T14:16:52.857316353Z","updated_at":"2026-11-07T14:48:11.583685Z"},{"id":"AZL-107988","title":"CVE-2026-102554 affecting package javapackages-bootstrap 1.14.0-5","description":"Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams.","status":"published","published":"2026-10-09T16:17:20Z","modified":"2026-11-03T05:33:06Z","updated_at":"2026-11-05T16:41:18.199293Z"},{"id":"openSUSE-SU-2026:12109-1","title":"guava-33.7.2-1.1 on GA media","description":"These are all security issues fixed in the guava-33.7.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-12T00:00:00Z","modified":"2026-10-13T10:30:06.851568248Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:22143-1","title":"Security update for guava","description":"This update for guava fixes the following issue:\n\n- CVE-2026-102554: Allocation of resources without limits or throttling (CWE-770) during Java object deserialization\n  allows an attacker to cause a Denial of Service via OutOfMemoryError (bsc#1284985).\n\nChanges for guava:\n\n- Adapt the generated OSGi data to reality\n- Upgrade to guava 33.7.2\n * Changes of 33.7.2\n + collect: Changed MapMaker, CompactHashMap, and CompactHashSet\n deserialization to avoid eagerly allocating as much memory as\n a serialization payload requests (bsc#1284985,\n CVE-2026-102554)\n * Changes of 33.7.1\n + removes the Multi-Release line from our jar manifest, fixing\n an issue under Java 9 and 10 that was introduced to guava-jre\n in version 33.7.0.\n * Changes of 33.7.0\n + Guava module-info.class is now present at the root of the jar\n instead of under a multi-release root. This prevents the jar\n from containing a file at META-INF/versions/9/OSGI-INF/\n /MANIFEST.MF, which occasionally causes trouble for some users\n + collect: Changed some ImmutableMap implementations to create a\n new, lightweight object on each call to view methods like\n keySet(), rather than creating and storing that object during\n the first call for reuse later. This is likely to slightly\n improve performance for some users, but it could lead to\n regressions in unusual cases, such as repeatedly calling\n asMultimap().inverse() on the same ImmutableMap instance.\n + net: Added HttpHeaders constant for on-prefetch-activation.\n + net: Added MediaType constants for application/yaml and\n application/x-pem-file.\n + util.concurrent: Fixed ExecutionSequencer queue stall when\n delegate executor throws RejectedExecutionException.\n * Changes of 33.6.0\n + Migrated some classes from finalize() to PhantomReference in\n preparation for the removal of finalization.\n + cache: Deprecated CacheBuilder APIs that use TimeUnit in favor\n of those that use Duration.\n + collect: Added toImmutableSortedMap collectors that use the\n natural comparator.\n + collect: Changed ConcurrentHashMultiset, ImmutableMultimap,\n and TreeMultiset deserialization to avoid mutating final\n fields. In extremely unlikely scenarios in which an instance\n of that type contains an object that refers back to that\n instance, this could lead to a broken instance that throws\n NullPointerException when used.\n + graph: Removed @Beta from all APIs in the package.\n + graph: Added support to Graphs.transitiveClosure() for\n different strategies for adding self-loops.\n + graph: Added an asNetwork() view to Graph and ValueGraph.\n + hash: Added BloomFilter.serializedSize().\n + net: Added HttpHeaders.CDN_CACHE_CONTROL.\n * Changes of 33.5.0\n + For users of guava-gwt: Google has moved off GWT internally.\n We plan to continue to release guava-gwt for users of GWT and\n J2CL, but the artifact is no longer tested for GWT-specific\n issues, and we have limited resources to fix any unexpected\n issues that might arise. While we do not anticipate any\n specific problems, we can't guarantee how long support will\n continue.\n + Listed the JSpecify annotations as an optional dependency in\n our OSGi metadata.\n + cache: Improved the handling of exceptions from compute\n functions in Cache.asMap(). (We do still recommend using\n Caffeine rather than com.google.common.cache.)\n + collect: Improved Iterators.mergeSorted() to preserve\n stability for equal elements.\n + math: Added saturatedAbs methods to IntMath and LongMath.\n + net: Added image/avif to MediaType.\n + util.concurrent: Added Striped.custom.\n","status":"published","published":"2026-10-20T14:30:21Z","modified":"2026-10-23T17:23:11.749917476Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:24263-1","title":"Security update for guava","description":"This update for guava fixes the following issue:\n\n- CVE-2026-102554: Allocation of resources without limits or throttling (CWE-770) during Java object deserialization\n  allows an attacker to cause a Denial of Service via OutOfMemoryError (bsc#1284985).\n\nChanges for guava:\n\n- Adapt the generated OSGi data to reality\n- Upgrade to guava 33.7.2\n * Changes of 33.7.2\n + collect: Changed MapMaker, CompactHashMap, and CompactHashSet\n deserialization to avoid eagerly allocating as much memory as\n a serialization payload requests (bsc#1284985,\n CVE-2026-102554)\n * Changes of 33.7.1\n + removes the Multi-Release line from our jar manifest, fixing\n an issue under Java 9 and 10 that was introduced to guava-jre\n in version 33.7.0.\n * Changes of 33.7.0\n + Guava module-info.class is now present at the root of the jar\n instead of under a multi-release root. This prevents the jar\n from containing a file at META-INF/versions/9/OSGI-INF/\n /MANIFEST.MF, which occasionally causes trouble for some users\n + collect: Changed some ImmutableMap implementations to create a\n new, lightweight object on each call to view methods like\n keySet(), rather than creating and storing that object during\n the first call for reuse later. This is likely to slightly\n improve performance for some users, but it could lead to\n regressions in unusual cases, such as repeatedly calling\n asMultimap().inverse() on the same ImmutableMap instance.\n + net: Added HttpHeaders constant for on-prefetch-activation.\n + net: Added MediaType constants for application/yaml and\n application/x-pem-file.\n + util.concurrent: Fixed ExecutionSequencer queue stall when\n delegate executor throws RejectedExecutionException.\n * Changes of 33.6.0\n + Migrated some classes from finalize() to PhantomReference in\n preparation for the removal of finalization.\n + cache: Deprecated CacheBuilder APIs that use TimeUnit in favor\n of those that use Duration.\n + collect: Added toImmutableSortedMap collectors that use the\n natural comparator.\n + collect: Changed ConcurrentHashMultiset, ImmutableMultimap,\n and TreeMultiset deserialization to avoid mutating final\n fields. In extremely unlikely scenarios in which an instance\n of that type contains an object that refers back to that\n instance, this could lead to a broken instance that throws\n NullPointerException when used.\n + graph: Removed @Beta from all APIs in the package.\n + graph: Added support to Graphs.transitiveClosure() for\n different strategies for adding self-loops.\n + graph: Added an asNetwork() view to Graph and ValueGraph.\n + hash: Added BloomFilter.serializedSize().\n + net: Added HttpHeaders.CDN_CACHE_CONTROL.\n * Changes of 33.5.0\n + For users of guava-gwt: Google has moved off GWT internally.\n We plan to continue to release guava-gwt for users of GWT and\n J2CL, but the artifact is no longer tested for GWT-specific\n issues, and we have limited resources to fix any unexpected\n issues that might arise. While we do not anticipate any\n specific problems, we can't guarantee how long support will\n continue.\n + Listed the JSpecify annotations as an optional dependency in\n our OSGi metadata.\n + cache: Improved the handling of exceptions from compute\n functions in Cache.asMap(). (We do still recommend using\n Caffeine rather than com.google.common.cache.)\n + collect: Improved Iterators.mergeSorted() to preserve\n stability for equal elements.\n + math: Added saturatedAbs methods to IntMath and LongMath.\n + net: Added image/avif to MediaType.\n + util.concurrent: Added Striped.custom.\n","status":"published","published":"2026-10-20T13:36:37Z","modified":"2026-10-23T17:23:10.677463702Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:5061-1","title":"Security update for guava, j2objc-annotations","description":"This update for guava, j2objc-annotations fixes the following issue:\n\n- CVE-2026-102554: Allocation of resources without limits or throttling (CWE-770) during Java object deserialization\n  allows an attacker to cause a Denial of Service via OutOfMemoryError (bsc#1284985).\n\nChanges for guava:\n\n- Upgrade to version 33.7.2\n\nChanges for j2objc-annotations:\n\n- Update to version 3.0.0\n","status":"published","published":"2026-11-03T07:29:47Z","modified":"2026-11-03T22:45:05.159747425Z","updated_at":"2026-11-03T22:59:30.419462Z"}]}}