CVE-2026-102554CWE-502CWE-770denial-of-serviceinsecure-deserialization

CVE-2026-102554

published October 9, 2026

CVSS
8.2
EPSS
0%
Percentile
27.6
In the wild
Unconfirmed
What it is

Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams.

The record
Technical detail
CVSS
8.2 · NONE
CVSS v4.0
8.2 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00352 · 27.6th percentile
Weaknesses
CWE-502 · Deserialization of Untrusted Data; CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-10-09T20:17Z
References (4)
https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe · [email protected]https://github.com/google/guava/releases/tag/v33.7.2 · [email protected]https://github.com/google/guava/security/advisories/GHSA-xxph-c9ww-hj94 · [email protected]https://github.com/google/guava/security/advisories/GHSA-xxph-c9ww-hj94 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 11 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 09 OCT 15:07Z
    Denial of Service via Eager Array Allocation During Deserialization in Guava
    cvelistv5
  • 09 OCT 15:07Z
    Denial of Service via Eager Array Allocation During Deserialization in Guava
    cvelistv5