ROOT-APP-MAVEN-CVE-2026-102554 CVE-2026-102554 in com.google.guava:guava - Patched by Root

Root has patched CVE-2026-102554 in the com.google.guava:guava package for Root:Maven. Multiple fixed versions available...

Denial-of-service (DoS)

com.google.guava:guava is vulnerable to a denial-of-service DoS. The vulnerability is due to Java object deserialization eagerly allocating memory based on a caller-specified size without proper limits, which allows an attacker to exhaust available memory using crafted serialization streams and...

ai.agentican:agentican-framework-core (>=0.1.0-alpha.2, <=0.1.0-alpha.4), ai.agentican:agentican-quarkus-deployment (>=0.1.0-alpha.2, <=0.1.0-alpha.4) +34802 more potentially affected by CVE-2026-102554 via com.google.guava:guava (>=33.0.0-android, <=33.7.1-jre)

com.google.guava:guava MAVEN version =33.0.0-android, =0.1.0-alpha.2, =0.1.0-alpha.2, =0.1.0-alpha.2, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.2, =0.1.0-alpha.2, =0.1.0-alpha.2, =0.1.0-alpha.2, =0.1.0-alpha.3, =0.1.0-alpha.2, =0.1.0, =0.1.0, =0.21.0-alpha.2, =0.1.1, =0.104.0 and more Source...

CVE-2024-22236

In Spring Cloud Contract, versions 4.1.x prior to 4.1.1, versions 4.0.x prior to 4.0.5, and versions 3.1.x prior to 3.1.10, test execution is vulnerable to local information disclosure via temporary directory created with unsafe permissions through the shaded com.google.guava:guava dependency in...

ai.djl.hadoop:hadoop (>=0.13.0, <=0.40.0), ai.eto:rikai_2.12 (>=0.1.7, <=0.1.14) +2939 more potentially affected by CVE-2020-8908 via com.google.guava:guava (27.0-jre)

com.google.guava:guava MAVEN version 27.0-jre is affected by a known vulnerability. The following packages have a transitive dependency on com.google.guava:guava and may be impacted: - ai.djl.hadoop:hadoop =0.13.0, =0.1.7, =0.1.7, =0.1.0, =0.2.2, =0.1.0, =0.1.0, =0.1.0, =0.1.6, =0.1.0, =1.0.5-sli...

ai.lum:odinson-rest-api_2.12 (>=0.2.0, <=0.2.3), androidx.databinding:databinding-compiler (>=3.6.0-alpha03, <=4.0.0-alpha09) +6211 more potentially affected by CVE-2020-8908 via com.google.guava:guava (27.1-jre)

com.google.guava:guava MAVEN version 27.1-jre is affected by a known vulnerability. The following packages have a transitive dependency on com.google.guava:guava and may be impacted: - ai.lum:odinson-rest-api2.12 =0.2.0, =3.6.0-alpha03, =3.6.0-alpha03, =0.5.0, =0.5.0, =1.3.1, =1.0.0-rc1,...

androidx.compose.material3.adaptive:adaptive-render-strategy (>=1.1.0-alpha03, <=1.1.0-alpha04), androidx.compose.material3.adaptive:adaptive-render-strategy-android (>=1.1.0-alpha03, <=1.1.0-alpha04) +758 more potentially affected by CVE-2020-8908 via com.google.guava:guava (28.1-android)

com.google.guava:guava MAVEN version 28.1-android is affected by a known vulnerability. The following packages have a transitive dependency on com.google.guava:guava and may be impacted: - androidx.compose.material3.adaptive:adaptive-render-strategy =1.1.0-alpha03, =1.1.0-alpha03, =1.6.0-beta01,...

ai.lum:odinson-rest-api_2.12 (>=0.3.1, <=0.5.0), ai.preferred:venom (>=4.2.3, <=4.2.5) +3698 more potentially affected by CVE-2020-8908 via com.google.guava:guava (28.1-jre)

com.google.guava:guava MAVEN version 28.1-jre is affected by a known vulnerability. The following packages have a transitive dependency on com.google.guava:guava and may be impacted: - ai.lum:odinson-rest-api2.12 =0.3.1, =4.2.3, =19.9.1, =19.9.1, =19.9.1, =19.9.1, =19.9.1, =19.9.1, =19.9.1,...

ai.grakn.kgms:client (1.4.3), ai.grakn.kgms:console (1.4.3) +3316 more potentially affected by CVE-2020-8908 via com.google.guava:guava (23.0)

com.google.guava:guava MAVEN version 23.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.google.guava:guava and may be impacted: - ai.grakn.kgms:client 1.4.3 - ai.grakn.kgms:console 1.4.3 - ai.grakn.kgms:grpc 1.4.3 - ai.grakn:client-java =1.4.1,...

at.ac.ait:ariadne-json-route-format (1.0-java7), com.google.guava:guava-testlib (23.3-android) +1 more potentially affected by CVE-2020-8908 via com.google.guava:guava (23.3-android)

com.google.guava:guava MAVEN version 23.3-android is affected by a known vulnerability. The following packages have a transitive dependency on com.google.guava:guava and may be impacted: - at.ac.ait:ariadne-json-route-format 1.0-java7 - com.google.guava:guava-testlib 23.3-android -...

android.arch.persistence.room:guava (>=1.1.0-alpha2, <=1.1.1), androidx.room:room-guava (>=2.0.0-alpha1, <=2.1.0-alpha04) +285 more potentially affected by CVE-2020-8908 via com.google.guava:guava (23.6-android)

com.google.guava:guava MAVEN version 23.6-android is affected by a known vulnerability. The following packages have a transitive dependency on com.google.guava:guava and may be impacted: - android.arch.persistence.room:guava =1.1.0-alpha2, =2.0.0-alpha1, =4.0.0, =1.3, =1.0.0, =1.0.0.beta5, =0.25....

com.github.vladimirantin:spring-core (1.1), com.google.guava:guava-gwt (13.0-rc1) +9 more potentially affected by CVE-2020-8908 via com.google.guava:guava (13.0-rc1)

com.google.guava:guava MAVEN version 13.0-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on com.google.guava:guava and may be impacted: - com.github.vladimirantin:spring-core 1.1 - com.google.guava:guava-gwt 13.0-rc1 -...

ai.berktest:berkclient (>=1.0.0, <=1.0.3), ai.dev-tools:ai-devtools (>=0.1.12, <=0.1.20) +2932 more potentially affected by CVE-2020-8908 via com.google.guava:guava (25.0-jre)

com.google.guava:guava MAVEN version 25.0-jre is affected by a known vulnerability. The following packages have a transitive dependency on com.google.guava:guava and may be impacted: - ai.berktest:berkclient =1.0.0, =0.1.12, =0.1.2, =0.0.1, =0.0.1, =2.0.0, =2.0.0, =2.0.0, =2.0, =0.9.6, =0.9.6,...

at.molindo:git-commit-id-plugin (2.1.10-alpha-1), at.researchstudio.sat:won-core (>=0.2, <=0.9) +4835 more potentially affected by CVE-2020-8908 via com.google.guava:guava (15.0)

com.google.guava:guava MAVEN version 15.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.google.guava:guava and may be impacted: - at.molindo:git-commit-id-plugin 2.1.10-alpha-1 - at.researchstudio.sat:won-core =0.2, =0.3, =0.2, =0.2, =0.3, =0.3,...

ai.chronon:aggregator_2.11 (>=chaining-0.0.46-dev, <=0.0.115), ai.chronon:aggregator_2.13 (>=chaining-0.0.46-dev, <=0.0.115) +8040 more potentially affected by CVE-2020-8908 via com.google.guava:guava (16.0.1)

com.google.guava:guava MAVEN version 16.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.google.guava:guava and may be impacted: - ai.chronon:aggregator2.11 =chaining-0.0.46-dev, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =chaining-0.0.46-dev,...

ae.teletronics.ejabberd:ejabberd-external-auth-java (1.0.0), ae.teletronics.toolbox:cache (>=0.8, <=0.9) +18328 more potentially affected by CVE-2020-8908 via com.google.guava:guava (18.0)

com.google.guava:guava MAVEN version 18.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.google.guava:guava and may be impacted: - ae.teletronics.ejabberd:ejabberd-external-auth-java 1.0.0 - ae.teletronics.toolbox:cache =0.8, =0.14.1, =0.9.6,...

ai.onehouse:lakeview (>=0.0.1, <=0.33.0), ai.onehouse:lakeview-sync-tool (>=0.18.5, <=0.33.0) +8196 more potentially affected by CVE-2020-8908 via com.google.guava:guava (30.1-jre)

com.google.guava:guava MAVEN version 30.1-jre is affected by a known vulnerability. The following packages have a transitive dependency on com.google.guava:guava and may be impacted: - ai.onehouse:lakeview =0.0.1, =0.18.5, =1.6.6, =1.6.6, =1.6.6, =1.6.6, =1.6.6, =1.6.6, =1.6.6.1, =1.10.23 -...

biz.netcentric.security:pickaxe-checks-example-aem-maven (>=2.4.2, <=2.4.3), biz.netcentric.security:pickaxe-core (>=2.4.2, <=2.4.3) +331 more potentially affected by CVE-2020-8908 via com.google.guava:guava (31.0-jre)

com.google.guava:guava MAVEN version 31.0-jre is affected by a known vulnerability. The following packages have a transitive dependency on com.google.guava:guava and may be impacted: - biz.netcentric.security:pickaxe-checks-example-aem-maven =2.4.2, =2.4.2, =2.4.2, =2.0, =0.0.1, =0.0.1, =0.0.1,...

ai.blip:deckard (>=0.0.23, <=0.0.26), ai.looktech:maestro-cli (>=2.6.0-looktech.1, <=2.10.0-looktech.0) +1258 more potentially affected by CVE-2020-8908 via com.google.guava:guava (31.1-android)

com.google.guava:guava MAVEN version 31.1-android is affected by a known vulnerability. The following packages have a transitive dependency on com.google.guava:guava and may be impacted: - ai.blip:deckard =0.0.23, =2.6.0-looktech.1, =2.6.0-looktech.1, =2.6.0-looktech.1, =2.6.0-looktech.1,...

com.artipie:asto (>=v1.3.0, <=1.2.1), com.artipie:composer-adapter (v1.0.1) +16 more potentially affected by CVE-2020-8908 via com.google.guava:guava (21.0-rc2)

com.google.guava:guava MAVEN version 21.0-rc2 is affected by a known vulnerability. The following packages have a transitive dependency on com.google.guava:guava and may be impacted: - com.artipie:asto =v1.3.0, =0.1, =test0.0.1, =v0.16, =v1.0, =v1.0, =v0.19, =v0.4.9, =0.4.8 -...