{"id":"AZL-106919","summary":"CVE-2026-102554 affecting package guava 33.0.0-1","details":"Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams.","modified":"2026-10-12T05:37:42Z","published":"2026-10-09T16:17:20Z","upstream":["CVE-2026-102554"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102554"}],"affected":[{"package":{"name":"guava","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/guava"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"33.0.0-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-106919.json"}}],"schema_version":"1.9.0"}