Skip to content
CVE PROGRAM SOURCE RECORD8.2 High

CVE-2026-102554

Denial of Service via Eager Array Allocation During Deserialization in Guava

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Google

Description

Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Google Guava

Default version status: unaffected

  • 4.0 to < 33.7.2affected

References