All vulnerabilities
CVE-2026-102554GHSA-xxph-c9ww-hj94

Denial of Service via Eager Array Allocation During Deserialization in Guava

Google Guava
Open in ThreatlineRecord JSON
CVSS
8.2High
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 9 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.35%Chance of exploitation activity in the next 30 days, higher than 27% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in33.7.2Fixed versionCVE List
Published9 Oct 2026Updated 9 Oct 2026CVE List

What fixes it

  • 33.7.2GuavaCVE List
  • 33.7.2com.google.guava:guava, mavenGitHub<dependency><groupId>com.google.guava</groupId><artifactId>guava</artifactId><version>33.7.2</version></dependency>

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams.

Text from CVE List

Affected versions 2

  • Guavaaffected: 4.0 before 33.7.2CVE List
  • com.google.guava:guava, maven4.0–33.7.1GitHub

References 3