{"id":"UBUNTU-CVE-2026-102554","details":"Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams.","modified":"2026-10-12T14:20:29.278560365Z","published":"2026-10-12T00:00:00Z","upstream":["CVE-2026-102554"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-102554"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-102554"},{"type":"REPORT","url":"github.com/google/guava"},{"type":"REPORT","url":"github.com/google/guava/commit/a0d0c36432c4cc7aa4b5063bab9f20d3d18fe9fc"},{"type":"REPORT","url":"github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe"},{"type":"REPORT","url":"github.com/google/guava/security/advisories/ghsa-xxph-c9ww-hj94"},{"type":"REPORT","url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1150495"},{"type":"REPORT","url":"security-tracker.debian.org/tracker/cve-2026-102554"},{"type":"REPORT","url":"github.com/cveproject/cvelistv5/tree/main/cves/2026/102xxx/cve-2026-102554.json"},{"type":"REPORT","url":"github.com/google/guava/releases/tag/v33.7.2"},{"type":"REPORT","url":"nvd.nist.gov/vuln/detail/cve-2026-102554"}],"affected":[{"package":{"name":"guava-libraries","ecosystem":"Ubuntu:14.04:LTS","purl":"pkg:deb/ubuntu/guava-libraries?arch=source&distro=trusty"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["14.0.1-1","15.0-2ubuntu1"],"ecosystem_specific":{"binaries":[{"binary_name":"libguava-java","binary_version":"15.0-2ubuntu1"}],"priority_reason":"Denial of service via memory exhaustion when deserializing untrusted Guava collections; requires application-specific untrusted deserialization."},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102554.json"}},{"package":{"name":"guava-libraries","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/guava-libraries?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["18.0-4ubuntu1","19.0-1"],"ecosystem_specific":{"binaries":[{"binary_name":"libguava-java","binary_version":"19.0-1"}],"priority_reason":"Denial of service via memory exhaustion when deserializing untrusted Guava collections; requires application-specific untrusted deserialization."},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102554.json"}},{"package":{"name":"guava-libraries","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/guava-libraries?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["19.0-1"],"ecosystem_specific":{"binaries":[{"binary_name":"libguava-java","binary_version":"19.0-1"}],"priority_reason":"Denial of service via memory exhaustion when deserializing untrusted Guava collections; requires application-specific untrusted deserialization."},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102554.json"}},{"package":{"name":"guava-libraries","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/guava-libraries?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["19.0-1"],"ecosystem_specific":{"priority_reason":"Denial of service via memory exhaustion when deserializing untrusted Guava collections; requires application-specific untrusted deserialization.","binaries":[{"binary_version":"19.0-1","binary_name":"libguava-java"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102554.json"}},{"package":{"name":"guava-libraries","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/guava-libraries?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["29.0-6"],"ecosystem_specific":{"binaries":[{"binary_name":"libguava-java","binary_version":"29.0-6"},{"binary_name":"libguava-testlib-java","binary_version":"29.0-6"}],"priority_reason":"Denial of service via memory exhaustion when deserializing untrusted Guava collections; requires application-specific untrusted deserialization."},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102554.json"}},{"package":{"name":"guava-libraries","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/guava-libraries?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["32.0.1-1"],"ecosystem_specific":{"priority_reason":"Denial of service via memory exhaustion when deserializing untrusted Guava collections; requires application-specific untrusted deserialization.","binaries":[{"binary_name":"libguava-java","binary_version":"32.0.1-1"},{"binary_version":"32.0.1-1","binary_name":"libguava-testlib-java"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102554.json"}},{"package":{"name":"guava-libraries","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/guava-libraries?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["32.0.1-1","32.0.1-1build1"],"ecosystem_specific":{"binaries":[{"binary_name":"libguava-java","binary_version":"32.0.1-1build1"},{"binary_name":"libguava-testlib-java","binary_version":"32.0.1-1build1"}],"priority_reason":"Denial of service via memory exhaustion when deserializing untrusted Guava collections; requires application-specific untrusted deserialization."},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102554.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"type":"Ubuntu","score":"medium"}]}