What’s Vulnerable › Vulnerabilities

CVE-2026-102554: Denial of Service via Eager Array Allocation During Deserialization in Guava

• Severity: high (CVSS 8.2 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-09 · updated 2026-10-09
• Weakness: CWE-502

Description

Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams.

Affected products

• Maven Com.Google.Guava:Guava: from 4.0 before 33.7.2; 10.0, 10.0-rc1, 10.0-rc2, 10.0-rc3, 10.0.1, 11.0 (+146) — fixed in 33.7.2
• Google Guava: from 4.0 before 33.7.2 — fixed in 33.7.2

How to fix

Upgrade to a fixed version: Maven Com.Google.Guava:Guava 33.7.2; Google Guava 33.7.2. Check the vendor advisory for mitigations.

References

• https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe
• https://github.com/google/guava/releases/tag/v33.7.2
• https://github.com/google/guava/security/advisories/GHSA-xxph-c9ww-hj94
• https://github.com/google/guava/security/advisories/GHSA-xxph-c9ww-hj94

Get alerted when CVE-2026-102554 or the next vulnerability affects your stack