Bug 2548685 (CVE-2026-102554) - CVE-2026-102554 com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization
Summary: CVE-2026-102554 com.google.guava/guava: Google Guava: Denial of Service via u...
Keywords:
Status: NEW
Alias: CVE-2026-102554
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2553430 2553433 2555503 2555505 2555506 2555507 2555509 2555512 2555513 2555514 2555515 2555517 2555520 2555522 2555526 2555529 2555531 2555532 2555539 2555540 2555542 2555543 2555524
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-09 15:33 UTC by OSIDB Bzimport
Modified: 2026-10-19 11:02 UTC (History)
141 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-09 15:33:15 UTC 
Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams.
Note You need to log in before you can comment on or make changes to this bug.