{"id":"RHLW-2026-688eb055fb69a082","summary":"Lightwell Security Advisory: guava 32.1.2.jre-rhlw-00001","details":"Red Hat Lightwell has released com.google.guava:guava 32.1.2.jre-rhlw-00001 with a backported security fix.\n\nCVE-2026-102554: Denial of Service via Eager Array Allocation During Deserialization in Guava\n\nThis patched artifact is a drop-in replacement for com.google.guava:guava 32.1.2.jre from Maven Central.","modified":"2026-11-12T08:45:02.558936812Z","published":"2026-11-12T01:37:03Z","upstream":["CVE-2026-102554","GHSA-xxph-c9ww-hj94"],"references":[{"type":"WEB","url":"https://github.com/google/guava/releases/tag/v33.7.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102554.json"},{"type":"ADVISORY","url":"https://github.com/google/guava/security/advisories/GHSA-xxph-c9ww-hj94"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102554"},{"type":"FIX","url":"https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe"},{"type":"PACKAGE","url":"https://github.com/google/guava"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-xxph-c9ww-hj94"}],"affected":[{"package":{"name":"com.google.guava:guava","ecosystem":"Red Hat Lightwell:Maven","purl":"pkg:maven/com.google.guava/guava"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32.1.2.jre-rhlw-00001"}]}],"versions":["10.0","10.0-rc1","10.0-rc2","10.0-rc3","10.0.1","11.0","11.0-rc1","11.0.1","11.0.2","12.0","12.0-rc1","12.0-rc2","12.0.1","13.0","13.0-rc1","13.0-rc2","13.0.1","14.0","14.0-rc1","14.0-rc2","14.0-rc3","14.0.1","15.0","15.0-rc1","16.0","16.0-rc1","16.0.1","17.0","17.0-rc1","17.0-rc2","18.0","18.0-rc1","18.0-rc2","19.0","19.0-rc1","19.0-rc2","19.0-rc3","20.0","20.0-rc1","21.0","21.0-rc1","21.0-rc2","22.0","22.0-android","22.0-rc1","22.0-rc1-android","23.0","23.0-android","23.0-rc1","23.0-rc1-android","23.1-android","23.1-jre","23.2-android","23.2-jre","23.3-android","23.3-jre","23.4-android","23.4-jre","23.5-android","23.5-jre","23.6-android","23.6-jre","23.6.1-android","23.6.1-jre","24.0-android","24.0-jre","24.1-android","24.1-jre","24.1.1-android","24.1.1-jre","25.0-android","25.0-jre","25.1-android","25.1-jre","26.0-android","26.0-jre","27.0-android","27.0-jre","27.0.1-android","27.0.1-jre","27.1-android","27.1-jre","28.0-android","28.0-jre","28.1-android","28.1-jre","28.2-android","28.2-jre","29.0-android","29.0-jre","30.0-android","30.0-jre","30.1-android","30.1-jre","30.1.1-android","30.1.1-jre","31.0-android","31.0-jre","31.0.1-android","31.0.1-jre","31.1-android","31.1-jre","32.0.0-android","32.0.0-jre","32.0.1-android","32.0.1-jre","32.1.0-android","32.1.0-jre","32.1.1-android","32.1.1-jre","32.1.2.jre","r03","r05","r06","r07","r08","r09"],"database_specific":{"lightwell":{"repository_url":"https://packages.redhat.com/lightwell/java/remediated/","backport_base_version":"32.1.2.jre","remediated_version":"32.1.2.jre-rhlw-00001"},"source":"https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-688eb055fb69a082.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"credits":[{"name":"Red Hat Lightwell","type":"REMEDIATION_DEVELOPER"}]}