AZL-106919

See a problem?

Import Source

https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-106919.json

JSON Data

https://api.osv.dev/v1/vulns/AZL-106919

Upstream

CVE-2026-102554

Published

2026-10-09T16:17:20Z

Modified

2026-10-11T05:36:19Z

Summary

CVE-2026-102554 affecting package guava 33.0.0-1

Details

Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-102554

Affected packages

Azure Linux:3 / guava

Package

Name: guava
Purl: pkg:rpm/azure-linux/guava

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

33.0.0-1

Database specific

source

"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-106919.json"