Google Guava: CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocation

CompactHashMap/CompactHashSet/MapMakerInternalMap native deserialization triggers uncontrolled memory allocation Summary CompactHashMap, CompactHashSet, and MapMakerInternalMap implement readObjectObjectInputStream by reading an attacker-controlled elementCount or initialCapacity from the stream...

GHSA-XXPH-C9WW-HJ94 Google Guava: CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocation

CompactHashMap/CompactHashSet/MapMakerInternalMap native deserialization triggers uncontrolled memory allocation Summary CompactHashMap, CompactHashSet, and MapMakerInternalMap implement readObjectObjectInputStream by reading an attacker-controlled elementCount or initialCapacity from the stream...

EUVD-2026-95889

Google Guava: CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocation...

SUSE SLES16 Security Update : guava (SUSE-SU-2026:24263-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:24263-1 advisory. This update for guava fixes the following issue: - CVE-2026-102554: Allocation of resources without limits or throttling CWE-770 during Jav...

guava-33.7.2-1.1 on GA media (moderate)

guava-33.7.2-1.1 on GA media Announcement ID: openSUSE-SU-2026:12109-1 Rating: moderate Cross-References: CVE-2026-102554 CVSS scores: CVE-2026-102554 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2026-102554 SUSE : 8.2...

openSUSE 16 Security Update : guava (openSUSE-SU-2026:22143-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:22143-1 advisory. This update for guava fixes the following issue: - CVE-2026-102554: Allocation of resources without limits or throttling CWE-770 during Java object...

Security update for guava (important)

openSUSE security update: security update for guava ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22143-1 Rating: important References: bsc1284985 Cross-References: CVE-2026-102554 CVSS scores: CVE-2026-102554 SUSE : 7.5...

OPENSUSE-SU-2026:22143-1 Security update for guava

This update for guava fixes the following issue: - CVE-2026-102554: Allocation of resources without limits or throttling CWE-770 during Java object deserialization allows an attacker to cause a Denial of Service via OutOfMemoryError bsc1284985. Changes for guava: - Adapt the generated OSGi data t...

SUSE-SU-2026:24263-1 Security update for guava

This update for guava fixes the following issue: - CVE-2026-102554: Allocation of resources without limits or throttling CWE-770 during Java object deserialization allows an attacker to cause a Denial of Service via OutOfMemoryError bsc1284985. Changes for guava: - Adapt the generated OSGi data t...

CVE-2026-102554

A flaw was found in Google Guava. During Java object deserialization—the process of converting stored data back into active program objects—memory is eagerly allocated based on caller-specified size parameters without proper throttling or limits. An attacker can exploit this issue by providing a...

CLEANSTART-2026-CK79983 Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1

Security vulnerability affects the strimzi-kafka-operator package. Use of Java's default temporary directory for file creation in FileBackedOutputStream in Google Guava versions 1...

CLEANSTART-2026-WG41098 temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com

Security vulnerability affects the strimzi-kafka-operator package. A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com...

CLEANSTART-2026-RP19895 Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4

Security vulnerability affects the elasticsearch package. Allocation of resources without limits or throttling CWE-770 during Java object deserialization in Google Guava versions 4...

SUSE CVE-2026-102554

Allocation of resources without limits or throttling CWE-770 during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances,...

OPENSUSE-SU-2026:12109-1 guava-33.7.2-1.1 on GA media

These are all security issues fixed in the guava-33.7.2-1.1 package on the GA media of openSUSE Tumbleweed...

Linux Distros Unpatched Vulnerability : CVE-2026-102554

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Allocation of resources without limits or throttling CWE-770 during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker t...

Allocation of Resources Without Limits or Throttling

Overview com.google.guava:guava is a set of core libraries that includes new collection types such as multimap and multiset,immutable collections, a graph library, functional types, an in-memory cache and more. Affected versions of this package are vulnerable to Allocation of Resources Without...

CVE-2026-102554

Allocation of resources without limits or throttling CWE-770 during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances,...

DEBIAN-CVE-2026-102554

Allocation of resources without limits or throttling CWE-770 during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances,...

AZL-106919 CVE-2026-102554 affecting package guava 33.0.0-1

Allocation of resources without limits or throttling CWE-770 during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances,...