AZL-107988

See a problem?

Import Source

https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-107988.json

JSON Data

https://api.osv.dev/v1/vulns/AZL-107988

Upstream

CVE-2026-102554

Published

2026-10-09T16:17:20Z

Modified

2026-10-15T05:37:09Z

Summary

CVE-2026-102554 affecting package javapackages-bootstrap 1.14.0-4

Details

Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-102554

Affected packages

Azure Linux:3 / javapackages-bootstrap

Package

Name: javapackages-bootstrap
Purl: pkg:rpm/azure-linux/javapackages-bootstrap

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

1.14.0-4

Database specific

source

"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-107988.json"