Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities

Summary IBM Enterprise Build of Quarkus is affected by vulnerabilities in MySQL client, Snappy Java, Apache CXF, Google Guava, LZ4-Java and Quarkus Vertx HTTP Vulnerability Details CVEID:CVE-2026-107912 DESCRIPTION: A flaw was found in the management interface of the Quarkus framework, specifical...

CLEANSTART-2026-SL64169 Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4

Security vulnerability affects the keycloak package. Allocation of resources without limits or throttling CWE-770 during Java object deserialization in Google Guava versions 4...

Security Bulletin: IBM Sterling Control Center is vulnerable to Guava Denial of Service (DoS) via Unthrottled Memory Allocation During Java Deserialization (CVE-2026-102554)

Summary A high-severity vulnerability in Google Guava versions 4.0 through 33.7.1 allows attackers to trigger a Denial of Service DoS through specially crafted Java serialized objects. This can cause excessive memory consumption, resulting in an OutOfMemoryError and application crash. The issue i...

Security Bulletin: IBM WebSphere Application Server is affected by a Deserialization of Untrusted Data vulnerability due to Google Guava (CVE-2026-102554)

Summary There is a vulnerability in the Google Guava library that affects IBM WebSphere Application Server. Vulnerability Details CVEID:CVE-2026-102554 DESCRIPTION: Allocation of resources without limits or throttling CWE-770 during Java object deserialization in Google Guava versions 4.0 through...

CLEANSTART-2026-BX48253 Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4

Security vulnerability affects the sonarqube package. Allocation of resources without limits or throttling CWE-770 during Java object deserialization in Google Guava versions 4...

CLEANSTART-2026-PW65051 Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4

CVE-2026-102554 affects multiple packages. Allocation of resources without limits or throttling CWE-770 during Java object deserialization in Google Guava versions 4. See references for individual vulnerability details...

CLEANSTART-2026-KS62022 Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1

Security vulnerability affects the cassandra-reaper-fips package. Use of Java's default temporary directory for file creation in FileBackedOutputStream in Google Guava versions 1...

CLEANSTART-2026-EH44989 Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4

Security vulnerability affects the sonarqube package. Allocation of resources without limits or throttling CWE-770 during Java object deserialization in Google Guava versions 4...

CLEANSTART-2026-UK97586 Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4

Security vulnerability affects the sonarqube package. Allocation of resources without limits or throttling CWE-770 during Java object deserialization in Google Guava versions 4...

Security Bulletin: IBM SPSS Analytic Server is affected by a Google Guava deserialization vulnerability that could cause a denial of service through excessive memory allocation

Summary IBM SPSS Analytic Server is affected by a Google Guava deserialization vulnerability that could cause a denial of service through excessive memory allocation. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-102554 DESCRIPTION: Allocation of resourc...

Google Guava: CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocation

CompactHashMap/CompactHashSet/MapMakerInternalMap native deserialization triggers uncontrolled memory allocation Summary CompactHashMap, CompactHashSet, and MapMakerInternalMap implement readObjectObjectInputStream by reading an attacker-controlled elementCount or initialCapacity from the stream...

EUVD-2026-95889

Google Guava: CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocation...

GHSA-XXPH-C9WW-HJ94 Google Guava: CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocation

CompactHashMap/CompactHashSet/MapMakerInternalMap native deserialization triggers uncontrolled memory allocation Summary CompactHashMap, CompactHashSet, and MapMakerInternalMap implement readObjectObjectInputStream by reading an attacker-controlled elementCount or initialCapacity from the stream...

AlmaLinux 9.2 [TuxCare] Security Update: guava / guava-javadoc / guava-testlib (ALMALINUX9.2:CLSA-2026:1793106858)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793106858 advisory. - Allocation of resources without limits or throttling CWE-770 during Java object deserialization in Google Guava versions 4.0 through 33.7.1...

CVE-2026-102554

A flaw was found in Google Guava. During Java object deserialization—the process of converting stored data back into active program objects—memory is eagerly allocated based on caller-specified size parameters without proper throttling or limits. An attacker can exploit this issue by providing a...

CLEANSTART-2026-CK79983 Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1

Security vulnerability affects the strimzi-kafka-operator package. Use of Java's default temporary directory for file creation in FileBackedOutputStream in Google Guava versions 1...

CLEANSTART-2026-RP19895 Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4

Security vulnerability affects the elasticsearch package. Allocation of resources without limits or throttling CWE-770 during Java object deserialization in Google Guava versions 4...

SUSE CVE-2026-102554

Allocation of resources without limits or throttling CWE-770 during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances,...

Linux Distros Unpatched Vulnerability : CVE-2026-102554

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Allocation of resources without limits or throttling CWE-770 during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker t...

DEBIAN-CVE-2026-102554

Allocation of resources without limits or throttling CWE-770 during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances,...