RHLW-2026-688EB055FB69A082 Lightwell Security Advisory: guava 32.1.2.jre-rhlw-00001

Red Hat Lightwell has released com.google.guava:guava 32.1.2.jre-rhlw-00001 with a backported security fix. CVE-2026-102554: Denial of Service via Eager Array Allocation During Deserialization in Guava This patched artifact is a drop-in replacement for com.google.guava:guava 32.1.2.jre from Maven...

CLEANSTART-2026-WR01453 Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4

Security vulnerability affects the strimzi-kafka-operator package. Allocation of resources without limits or throttling CWE-770 during Java object deserialization in Google Guava versions 4...

Important: Red Hat Security Advisory: guava security update

An update for guava is now available for Red Hat Enterprise Linux 9.8 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization

A flaw was found in Google Guava. During Java object deserialization—the process of converting stored data back into active program objects—memory is eagerly allocated based on caller-specified size parameters without proper throttling or limits. An attacker can exploit this issue by providing a...

Important: Red Hat Security Advisory: guava security update

An update for guava is now available for Red Hat Enterprise Linux 10.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization

A flaw was found in Google Guava. During Java object deserialization—the process of converting stored data back into active program objects—memory is eagerly allocated based on caller-specified size parameters without proper throttling or limits. An attacker can exploit this issue by providing a...

Important: Red Hat Security Advisory: guava security update

An update for guava is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization

A flaw was found in Google Guava. During Java object deserialization—the process of converting stored data back into active program objects—memory is eagerly allocated based on caller-specified size parameters without proper throttling or limits. An attacker can exploit this issue by providing a...

Important: Red Hat Security Advisory: guava security update

An update for guava is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization

A flaw was found in Google Guava. During Java object deserialization—the process of converting stored data back into active program objects—memory is eagerly allocated based on caller-specified size parameters without proper throttling or limits. An attacker can exploit this issue by providing a...

Security Bulletin: IBM ApplinX is vulnerable to a vulnerability due to use of Google Guava (CVE-2026-102554)

Summary IBM ApplinX is vulnerable to a vulnerability due to use of a third-party library: Google Guava is vulnerable to deserialization of untrusted data and allocation of resources without limits vulnerabilities CVE-2026-102554. The affected versions have been updated within IBM ApplinX in order...

CLEANSTART-2026-LV29506 Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4

CVE-2026-102554 affects multiple packages. Allocation of resources without limits or throttling CWE-770 during Java object deserialization in Google Guava versions 4. See references for individual vulnerability details...

RHEL 9 : guava (RHSA-2026:98498)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:98498 advisory. Guava is a suite of core and expanded libraries that include utility classes, Googles collections, io classes, and much much more. This project is a...

RHEL 10 : guava (RHSA-2026:98602)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:98602 advisory. Guava is a suite of core and expanded libraries that include utility classes, Googles collections, io classes, and much much more. This project is ...

RHEL 10 : guava (RHSA-2026:99091)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:99091 advisory. Guava is a suite of core and expanded libraries that include utility classes, Googles collections, io classes, and much much more. This project is ...

Security Bulletin: IBM Data Replication AI Edition 12.0.0 is affected by injection, denial of service, and path traversal vulnerabilities in Apache Derby, PostgreSQL JDBC Driver, Google Guava, Jakarta Mail, and Kubernetes Java client.

Summary IBM has released the below fix for IBM Data Replication AI Edition 12.0.0 in response to multiple vulnerabilities in open source Java libraries. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2018-1313 DESCRIPTION: In Apache Derb...

Security Bulletin: IBM SPSS Modeler is affected by a Google Guava deserialization vulnerability that could cause denial of service through memory exhaustion

Summary IBM SPSS Modeler is affected by a Google Guava deserialization vulnerability that could cause denial of service through memory exhaustion. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-102554 DESCRIPTION: Allocation of resources without limits or...

Amazon Linux 2023 : guava, guava-javadoc, guava-testlib (ALAS2023-2026-3419)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3419 advisory. Allocation of resources without limits or throttling CWE-770 during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via...

Amazon Linux 2023 : javapackages-bootstrap (ALAS2023-2026-3418)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3418 advisory. Allocation of resources without limits or throttling CWE-770 during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via...

Medium: guava

Issue Overview: Allocation of resources without limits or throttling CWE-770 during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalM...