Multiple security vulnerabilities have been identified in Guava, a widely used Java utility library. The issues affect native Java deserialization paths in collection and map components, allowing an attacker who can supply serialized data to trigger excessive memory allocation and cause denial of service. Affected versions are reported as Guava 4.0 through 33.7.1. The overall risk is availability impact for applications that deserialize untrusted data with Guava present.
CVE-2026-102554 (CVSS 8.2 — High): Guava's compact hash map and set collection components, along with an internal map component, read a size value from serialized data without validating it against the actual payload. A remote, unauthenticated attacker who can supply a small crafted serialized object can force large memory allocation before the stream is fully consumed, causing an out-of-memory condition and denial of service.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in Guava, a widely used Java utility library. The issues affect native Java deserialization paths in collection and map components, allowing an attacker who can supply serialized data to trigger excessive memory allocation and cause denial of service. Affected versions are reported as Guava 4.0 through 33.7.1. The overall risk is availability impact for applications that deserialize untrusted data with Guava present.
CVE-2026-102554 (CVSS 8.2 — High): Guava's compact hash map and set collection components, along with an internal map component, read a size value from serialized data without validating it against the actual payload. A remote, unauthenticated attacker who can supply a small crafted serialized object can force large memory allocation before the stream is fully consumed, causing an out-of-memory condition and denial of service.[emaillocker id="1283"]
CVE-2018-10237: This earlier Guava issue involved a similar deserialization amplification pattern in an array-based numeric collection and ordering component, where a declared size could trigger premature allocation before the actual serialized content was verified. It is referenced as a precedent for the current collection deserialization weakness.
These vulnerabilities collectively present a significant denial-of-service risk for Java applications that deserialize untrusted data while using Guava. The greatest exposure is for network-facing services that accept serialized objects from external users or integrate third-party libraries that perform deserialization. The general action is to reduce exposure to untrusted serialized input and monitor availability for abnormal memory consumption.
We recommend you to update Guava to version 33.7.2.
The following reports contain further technical details:
[/emaillocker]