CVE-2026-102554

Name	CVE-2026-102554
Description	Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1150495

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
guava-libraries (PTS)	bookworm	31.1-1	vulnerable
	trixie	32.0.1-1	vulnerable
	forky, sid	33.7.1-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
guava-libraries	source	(unstable)	(unfixed)			1150495

Notes

https://github.com/google/guava/security/advisories/GHSA-xxph-c9ww-hj94
Fixed by: https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe (master)
Fixed by: https://github.com/google/guava/commit/a0d0c36432c4cc7aa4b5063bab9f20d3d18fe9fc (v33.7.2)