Skip to content
Fencer Vulns
medium 5.9

CVE-2026-102554 json

Denial of Service via Eager Array Allocation During Deserialization in Guava

published 2026-10-09 30 d ago modified 2026-10-27 12 d ago also GHSA-xxph-c9ww-hj94 , EUVD-2026-95889

cvss
5.9
version 3.1, GitHub
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 29%
public exploits
0
none known

Summary

Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams.

Patch / fix

  • maven com.google.guava:guava 33.7.2
  • Google Guava 33.7.2
  • j2objc-annotations SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 3.0.0-150200.5.8.1
  • guava SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 33.7.2-150200.3.20.1
  • jspecify SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 1.0.0-150200.5.5.1
  • guava SLES for SAP applications 16.0, SLES 16.0 33.7.2-160000.1.1

suse advisories SUSE-SU-2026:5061-1SUSE-SU-2026:24263-1

  • guava openSUSE Leap 16.0 33.7.2-160000.1.1
  • guava openSUSE Tumbleweed 33.7.2-1.1

opensuse advisories openSUSE-SU-2026:22143-1openSUSE-SU-2026:12109-1

  • guava Azure Linux 3.0 33.0.0-2

azure linux advisories AZL-106919

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-102554 updated cvss 7.5

com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization

  • Red Hat Exploit Intelligence exploit-intelligence/vulnerability-analysis-rhel9 Red Hat Migration Toolkit for Applications 8 mta/mta-cli-rhel9, mta/mta-java-external-provider-rhel9 Red Hat OpenShift Developer Tools and Services jenkins, ocp-tools-4/jenkins-rhel8, ocp-tools-4/jenkins-rhel9 Red Hat OpenShift Serverless openshift-serverless-1/logic-rhel9-operator, openshift-serverless-1/kn-ekb-receiver-rhel9, openshift-serverless-1/kn-ekb-dispatcher-rhel9, openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9, openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9, openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9, +5 more Red Hat AMQ Broker 7 guava Red Hat build of Apache Camel 4 for Quarkus 3 guava
    +5 more products
    Red Hat build of Apache Camel for Spring Boot 4 guava Red Hat build of Apicurio Registry 3 guava Red Hat Build of Keycloak guava, rhbk/keycloak-rhel9 Red Hat build of OpenJDK Konflux Container Build ubi10/openjdk-21, ubi10/openjdk-25 Red Hat build of Quarkus guava
    affected: workaround, no fix available
  • Red Hat Ceph Storage 7 thrift, liborc1 Red Hat Ceph Storage 8 thrift, liborc1, thrift-qt, perl-thrift, thrift-glib, python3-thrift Red Hat Ceph Storage 9 liborc, thrift, liborc2, libarrow, protobuf, parquet-libs
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Enterprise Linux 7 guava, guava-javadoc Red Hat Enterprise Linux 8 guava, guava-javadoc, guava-testlib
    affected: workaround, no fix available
  • Red Hat Enterprise Linux 9 jmc, guava, librbd1, librados2, assertj-core, guava-javadoc, +1 more
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Enterprise Linux 10 guava, javaparser, assertj-core, maven-dependency-analyzer
    affected: workaround, no fix available
  • Red Hat JBoss Enterprise Application Platform 7 guava, jboss-eap-7/eap74-els-openjdk8-openshift-rhel8, jboss-eap-7/eap74-els-openjdk11-openshift-rhel8, jboss-eap-7/eap74-els-openjdk17-openshift-rhel8
    affected: workaround, no fix planned “Will not fix”
  • Red Hat JBoss Enterprise Application Platform 8 guava, jboss-eap-8/eap81-openjdk17-builder-openshift-rhel9, jboss-eap-8-tech-preview/eap81-openjdk17-builder-openshift-rhel9, jboss-eap-8-tech-preview/eap81-openjdk21-builder-openshift-rhel9 Red Hat OpenShift AI (RHOAI) rhoai/odh-modelmesh-rhel9, rhoai/odh-vllm-cuda-rhel9, rhoai/odh-feature-server-rhel9, rhoai/odh-spark-operator-rhel9, rhoai/odh-trustyai-service-rhel9 Red Hat OpenShift Dev Spaces devspaces/udi-rhel9, devspaces/server-rhel9, devspaces/openvsx-rhel9, devspaces/jetbrains-ide-rhel9, devspaces/pluginregistry-rhel9 Red Hat Single Sign-On 7 guava Red Hat streams for Apache Kafka 3 guava
    affected: workaround, no fix available
  • Red Hat Build of Apache Camel 3.33.4.SP3 guava 33.7.2.jre-redhat-00002
    fixed: vendor fix RHSA-2026:95622
show 5 more
  • Red Hat Exploit Intelligence exploit-intelligence/agent-client-rhel9 Red Hat AI Inference Server rhaii/vllm-gaudi-rhel9, rhaiis/vllm-cuda-rhel9 Red Hat AMQ Clients protobuf Red Hat Ansible Automation Platform 2 python-protobuf, python3x-protobuf, python3.11-protobuf Red Hat Build of Apache Camel 3.33.4.SP3 jimfs 1.1, jna 5.8.0, bcel 6.7.0, gax 2.74.1, icu4j 78.2, joni 2.2.6, +1616 more Red Hat Enterprise Linux 8 guava20, protobuf, protobuf-lite, guava20-javadoc, guava20-testlib, python3-protobuf, +3 more
    +3 more products
    Red Hat Enterprise Linux 9 protobuf, protobuf-lite, python3-protobuf, protobuf-compiler, jackson-jaxrs-providers, pki-jackson-jaxrs-providers, +1 more Red Hat Enterprise Linux 10 protobuf Red Hat Enterprise Linux AI (RHEL AI) 3 thrift, rhelai3/bootc-gaudi-rhel9
    not affected: vulnerable code not present
  • Red Hat Fuse 7 guava
    not affected: vulnerable code not in execute path
  • Red Hat Hardened Images protobuf, icu 78.3-8.hum1, maven3.9 3.9.16-0.3.hum1 Red Hat JBoss Enterprise Application Platform Expansion Pack guava Red Hat JBoss Web Server 7 jws7-ecj
    not affected: component not present
  • Red Hat Offline Knowledge Portal offline-knowledge-portal/rhokp-rhel9
    not affected: vulnerable code not in execute path
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-vllm-gaudi-rhel9, rhoai/odh-th-torch-cpu-py312-rhel9, rhoai/odh-th-torch-cuda-py312-rhel9, rhoai/odh-th06-cpu-torch210-py312-rhel9, rhoai/odh-th06-cpu-torch291-py312-rhel9, rhai-early-access/docling-serve-cuda-rhel9, +15 more
    not affected: vulnerable code not present

2 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
30 d ago

Exploit prediction

0.35% chance of exploitation in the next 30 days, higher than 29% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/google/guava/security/advisories/GHSA-xxph-c9ww-hj94 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 8.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CNA 4.0 8.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
GitHub 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
maven com.google.guava:guava
>=4.0, <33.7.2
33.7.2

Affected products

  • Google Guava

Classification

Weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling
  • CWE-502 Deserialization of Untrusted Data
  • CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.