SB2026103021 - Deserialization of untrusted data in Google Guava

Description

This security bulletin contains information about 1 vulnerability.

1) Deserialization of Untrusted Data (CVE-ID: CVE-2026-102554)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams, when deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances. A remote attacker can pass specially crafted data to the application and perform a denial of service attack.

Remediation

Install update from vendor's website.

References

• https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe
• https://github.com/google/guava/releases/tag/v33.7.2
• https://github.com/google/guava/security/advisories/GHSA-xxph-c9ww-hj94