{"id":"CVE-2026-102554","summary":"Denial of Service via Eager Array Allocation During Deserialization in Guava","details":"Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams.","aliases":["GHSA-xxph-c9ww-hj94"],"modified":"2026-10-11T07:05:35.617849001Z","published":"2026-10-09T15:07:16.130Z","database_specific":{"cwe_ids":["CWE-502","CWE-770"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102554.json","unresolved_ranges":[{"extracted_events":[{"introduced":"4.0"},{"fixed":"33.7.2"}],"source":"AFFECTED_FIELD"},{"extracted_events":[{"introduced":"4.0"},{"fixed":"33.7.1"}],"source":"DESCRIPTION"}],"cna_assigner":"Google"},"references":[{"type":"WEB","url":"https://github.com/google/guava/releases/tag/v33.7.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102554.json"},{"type":"ADVISORY","url":"https://github.com/google/guava/security/advisories/GHSA-xxph-c9ww-hj94"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102554"},{"type":"FIX","url":"https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe"},{"type":"PACKAGE","url":"https://github.com/google/guava"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/google/guava","events":[{"introduced":"0"},{"fixed":"b931fe9d6d5cf00bc55714ad3308d086f71850fe"}],"database_specific":{"source":"REFERENCES"}}],"versions":["failureaccess-v1.0.3","failureaccess-v1.0.2","failureaccess-v1.0.1","released-all-futures","jdk5-backport-branch-point","v7.0","v2.0"],"database_specific":{"vanir_signatures_modified":"2026-10-11T07:05:35Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102554.json","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe","target":{"file":"guava/src/com/google/common/collect/CompactHashMap.java"},"deprecated":false,"digest":{"line_hashes":["36265851560868299880939795439181956076","69528116622756927640930386608966442521","155500155850956410739055592773221225468","85613651795865332116405503823834610621"],"threshold":0.9},"id":"CVE-2026-102554-0016f8d7","signature_type":"Line"},{"id":"CVE-2026-102554-05e3cc0d","signature_type":"Line","signature_version":"v1","source":"https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe","target":{"file":"guava-tests/test/com/google/common/collect/MapMakerInternalMapTest.java"},"deprecated":false,"digest":{"line_hashes":["89496161230219505783010149130985249900","45560112062874529148079462505614560544","182270252190869235599155943112417497080","11460687084427128608354435331905366114","123112877633421088900130299915369945665","30572583338987530379332025129284894092","129646280021401866441045803108546949009"],"threshold":0.9}},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["71626258481032253417131936034474401799","323955338389323275818255393166966824905","294327381601872521485243223371204556380","126613078116292020333038807443840534630"]},"id":"CVE-2026-102554-14cd93b1","signature_type":"Line","signature_version":"v1","source":"https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe","target":{"file":"android/guava/src/com/google/common/collect/MapMakerInternalMap.java"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe","target":{"file":"guava/src/com/google/common/collect/CompactHashSet.java"},"deprecated":false,"digest":{"line_hashes":["36265851560868299880939795439181956076","69528116622756927640930386608966442521","186021738141839356925345385667730207814","282236490559093345445999076029825681216"],"threshold":0.9},"id":"CVE-2026-102554-2a3bae12"},{"target":{"file":"guava/src/com/google/common/collect/CompactHashSet.java","function":"readObject"},"deprecated":false,"digest":{"length":333,"function_hash":"195287922028024899206726359463390314993"},"id":"CVE-2026-102554-2d215855","signature_type":"Function","signature_version":"v1","source":"https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe"},{"deprecated":false,"digest":{"line_hashes":["238190478366525546815576307010782487680","48400952076385145082880287435148557193","333795636287405832611474303066221993579","313373452615637962178689419649927462042","295345732771440348828241394289425554781","309791702315305498600510386796572794213","281185031991957870375503044512903737552","273531679647203249344782023591675532414","113890787197034973877497718155951350450","191047175653414420204067741886341893197","160897531456351311476597464234799193426","94667174876049683382792163495807874065"],"threshold":0.9},"id":"CVE-2026-102554-2f27a3fb","signature_type":"Line","signature_version":"v1","source":"https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe","target":{"file":"android/guava-tests/test/com/google/common/collect/CompactHashSetTest.java"}},{"signature_version":"v1","source":"https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe","target":{"function":"readMapMaker","file":"guava/src/com/google/common/collect/MapMakerInternalMap.java"},"deprecated":false,"digest":{"length":234,"function_hash":"303781002469850239087564506599856783536"},"id":"CVE-2026-102554-523c3064","signature_type":"Function"},{"id":"CVE-2026-102554-6b33c53b","signature_type":"Line","signature_version":"v1","source":"https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe","target":{"file":"android/guava-tests/test/com/google/common/collect/MapMakerInternalMapTest.java"},"deprecated":false,"digest":{"line_hashes":["89496161230219505783010149130985249900","45560112062874529148079462505614560544","182270252190869235599155943112417497080","11460687084427128608354435331905366114","123112877633421088900130299915369945665","30572583338987530379332025129284894092","129646280021401866441045803108546949009"],"threshold":0.9}},{"id":"CVE-2026-102554-8a205903","signature_type":"Function","signature_version":"v1","source":"https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe","target":{"file":"android/guava/src/com/google/common/collect/MapMakerInternalMap.java","function":"readMapMaker"},"deprecated":false,"digest":{"function_hash":"303781002469850239087564506599856783536","length":234}},{"signature_version":"v1","source":"https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe","target":{"file":"android/guava/src/com/google/common/collect/CompactHashMap.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["36265851560868299880939795439181956076","69528116622756927640930386608966442521","155500155850956410739055592773221225468","85613651795865332116405503823834610621"]},"id":"CVE-2026-102554-8d89d53f","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe","target":{"file":"android/guava/src/com/google/common/collect/CompactHashMap.java","function":"readObject"},"deprecated":false,"digest":{"function_hash":"205706041375008853154874208443075687379","length":384},"id":"CVE-2026-102554-9961647e","signature_type":"Function"},{"digest":{"line_hashes":["36265851560868299880939795439181956076","69528116622756927640930386608966442521","186021738141839356925345385667730207814","282236490559093345445999076029825681216"],"threshold":0.9},"id":"CVE-2026-102554-9b4424c3","signature_type":"Line","signature_version":"v1","source":"https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe","target":{"file":"android/guava/src/com/google/common/collect/CompactHashSet.java"},"deprecated":false},{"digest":{"function_hash":"195287922028024899206726359463390314993","length":333},"id":"CVE-2026-102554-a1b5a933","signature_type":"Function","signature_version":"v1","source":"https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe","target":{"function":"readObject","file":"android/guava/src/com/google/common/collect/CompactHashSet.java"},"deprecated":false},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["20844557412769902748216963438585814676","72419251582803430013834669186547251320","150407209162837196683988779215433356241","95443147109136191844975213298223163606","211111964663615221813888094187816102815","57259815959556124625734628440700458788","55730995002479030752135168310537277791","118894388676256217080940525446444461346","43757446850151211962677717556247263725","235794854518735083966017557084635419995","149819526429080839920868251802347539925","321718743850617423320635728919603529748"]},"id":"CVE-2026-102554-b0ca855e","signature_type":"Line","signature_version":"v1","source":"https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe","target":{"file":"guava-tests/test/com/google/common/collect/CompactHashMapTest.java"}},{"id":"CVE-2026-102554-c6fb1efc","signature_type":"Function","signature_version":"v1","source":"https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe","target":{"file":"guava/src/com/google/common/collect/CompactHashMap.java","function":"readObject"},"deprecated":false,"digest":{"function_hash":"205706041375008853154874208443075687379","length":384}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe","target":{"file":"guava/src/com/google/common/collect/MapMakerInternalMap.java"},"deprecated":false,"digest":{"line_hashes":["71626258481032253417131936034474401799","323955338389323275818255393166966824905","294327381601872521485243223371204556380","126613078116292020333038807443840534630"],"threshold":0.9},"id":"CVE-2026-102554-d7295bfb"},{"deprecated":false,"digest":{"line_hashes":["238190478366525546815576307010782487680","48400952076385145082880287435148557193","333795636287405832611474303066221993579","313373452615637962178689419649927462042","295345732771440348828241394289425554781","309791702315305498600510386796572794213","281185031991957870375503044512903737552","273531679647203249344782023591675532414","11066813988941769770638659142924321196","319315509107053480197575825093538176520","160897531456351311476597464234799193426","94667174876049683382792163495807874065"],"threshold":0.9},"id":"CVE-2026-102554-f2d3620c","signature_type":"Line","signature_version":"v1","source":"https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe","target":{"file":"guava-tests/test/com/google/common/collect/CompactHashSetTest.java"}},{"signature_version":"v1","source":"https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe","target":{"file":"android/guava-tests/test/com/google/common/collect/CompactHashMapTest.java"},"deprecated":false,"digest":{"line_hashes":["20844557412769902748216963438585814676","72419251582803430013834669186547251320","150407209162837196683988779215433356241","95443147109136191844975213298223163606","211111964663615221813888094187816102815","57259815959556124625734628440700458788","55730995002479030752135168310537277791","118894388676256217080940525446444461346","43757446850151211962677717556247263725","235794854518735083966017557084635419995","149819526429080839920868251802347539925","321718743850617423320635728919603529748"],"threshold":0.9},"id":"CVE-2026-102554-ff05c3bf","signature_type":"Line"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}