CVE-2026-102554

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-102554
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102554.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-102554
Aliases
  • GHSA-xxph-c9ww-hj94
Downstream
Published
2026-10-09T15:07:16Z
Modified
2026-10-11T07:05:35Z
Severity
  • 8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Denial of Service via Eager Array Allocation During Deserialization in Guava
Details

Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams.

Database specific 
{
    "cna_assigner": "Google",
    "cwe_ids": [
        "CWE-502",
        "CWE-770"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102554.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "4.0"
                },
                {
                    "fixed": "33.7.2"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "extracted_events": [
                {
                    "introduced": "4.0"
                },
                {
                    "fixed": "33.7.1"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}
References

Affected packages

Git / github.com/google/guava

Affected ranges

Type
GIT
Repo
https://github.com/google/guava
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b931fe9d6d5cf00bc55714ad3308d086f71850fe
Database specific
Show details 
{
    "source": "REFERENCES"
}

Affected versions

failureaccess-v1.*
failureaccess-v1.0.1
failureaccess-v1.0.2
failureaccess-v1.0.3
Other
jdk5-backport-branch-point
released-all-futures
v2.*
v2.0
v7.*
v7.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102554.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "36265851560868299880939795439181956076",
                "69528116622756927640930386608966442521",
                "155500155850956410739055592773221225468",
                "85613651795865332116405503823834610621"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-102554-0016f8d7",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe",
        "target": {
            "file": "guava/src/com/google/common/collect/CompactHashMap.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "89496161230219505783010149130985249900",
                "45560112062874529148079462505614560544",
                "182270252190869235599155943112417497080",
                "11460687084427128608354435331905366114",
                "123112877633421088900130299915369945665",
                "30572583338987530379332025129284894092",
                "129646280021401866441045803108546949009"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-102554-05e3cc0d",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe",
        "target": {
            "file": "guava-tests/test/com/google/common/collect/MapMakerInternalMapTest.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "71626258481032253417131936034474401799",
                "323955338389323275818255393166966824905",
                "294327381601872521485243223371204556380",
                "126613078116292020333038807443840534630"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-102554-14cd93b1",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe",
        "target": {
            "file": "android/guava/src/com/google/common/collect/MapMakerInternalMap.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "36265851560868299880939795439181956076",
                "69528116622756927640930386608966442521",
                "186021738141839356925345385667730207814",
                "282236490559093345445999076029825681216"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-102554-2a3bae12",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe",
        "target": {
            "file": "guava/src/com/google/common/collect/CompactHashSet.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "195287922028024899206726359463390314993",
            "length": 333
        },
        "id": "CVE-2026-102554-2d215855",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe",
        "target": {
            "file": "guava/src/com/google/common/collect/CompactHashSet.java",
            "function": "readObject"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "238190478366525546815576307010782487680",
                "48400952076385145082880287435148557193",
                "333795636287405832611474303066221993579",
                "313373452615637962178689419649927462042",
                "295345732771440348828241394289425554781",
                "309791702315305498600510386796572794213",
                "281185031991957870375503044512903737552",
                "273531679647203249344782023591675532414",
                "113890787197034973877497718155951350450",
                "191047175653414420204067741886341893197",
                "160897531456351311476597464234799193426",
                "94667174876049683382792163495807874065"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-102554-2f27a3fb",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe",
        "target": {
            "file": "android/guava-tests/test/com/google/common/collect/CompactHashSetTest.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "303781002469850239087564506599856783536",
            "length": 234
        },
        "id": "CVE-2026-102554-523c3064",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe",
        "target": {
            "file": "guava/src/com/google/common/collect/MapMakerInternalMap.java",
            "function": "readMapMaker"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "89496161230219505783010149130985249900",
                "45560112062874529148079462505614560544",
                "182270252190869235599155943112417497080",
                "11460687084427128608354435331905366114",
                "123112877633421088900130299915369945665",
                "30572583338987530379332025129284894092",
                "129646280021401866441045803108546949009"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-102554-6b33c53b",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe",
        "target": {
            "file": "android/guava-tests/test/com/google/common/collect/MapMakerInternalMapTest.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "303781002469850239087564506599856783536",
            "length": 234
        },
        "id": "CVE-2026-102554-8a205903",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe",
        "target": {
            "file": "android/guava/src/com/google/common/collect/MapMakerInternalMap.java",
            "function": "readMapMaker"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "36265851560868299880939795439181956076",
                "69528116622756927640930386608966442521",
                "155500155850956410739055592773221225468",
                "85613651795865332116405503823834610621"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-102554-8d89d53f",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe",
        "target": {
            "file": "android/guava/src/com/google/common/collect/CompactHashMap.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "205706041375008853154874208443075687379",
            "length": 384
        },
        "id": "CVE-2026-102554-9961647e",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe",
        "target": {
            "file": "android/guava/src/com/google/common/collect/CompactHashMap.java",
            "function": "readObject"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "36265851560868299880939795439181956076",
                "69528116622756927640930386608966442521",
                "186021738141839356925345385667730207814",
                "282236490559093345445999076029825681216"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-102554-9b4424c3",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe",
        "target": {
            "file": "android/guava/src/com/google/common/collect/CompactHashSet.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "195287922028024899206726359463390314993",
            "length": 333
        },
        "id": "CVE-2026-102554-a1b5a933",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe",
        "target": {
            "file": "android/guava/src/com/google/common/collect/CompactHashSet.java",
            "function": "readObject"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "20844557412769902748216963438585814676",
                "72419251582803430013834669186547251320",
                "150407209162837196683988779215433356241",
                "95443147109136191844975213298223163606",
                "211111964663615221813888094187816102815",
                "57259815959556124625734628440700458788",
                "55730995002479030752135168310537277791",
                "118894388676256217080940525446444461346",
                "43757446850151211962677717556247263725",
                "235794854518735083966017557084635419995",
                "149819526429080839920868251802347539925",
                "321718743850617423320635728919603529748"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-102554-b0ca855e",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe",
        "target": {
            "file": "guava-tests/test/com/google/common/collect/CompactHashMapTest.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "205706041375008853154874208443075687379",
            "length": 384
        },
        "id": "CVE-2026-102554-c6fb1efc",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe",
        "target": {
            "file": "guava/src/com/google/common/collect/CompactHashMap.java",
            "function": "readObject"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "71626258481032253417131936034474401799",
                "323955338389323275818255393166966824905",
                "294327381601872521485243223371204556380",
                "126613078116292020333038807443840534630"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-102554-d7295bfb",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe",
        "target": {
            "file": "guava/src/com/google/common/collect/MapMakerInternalMap.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "238190478366525546815576307010782487680",
                "48400952076385145082880287435148557193",
                "333795636287405832611474303066221993579",
                "313373452615637962178689419649927462042",
                "295345732771440348828241394289425554781",
                "309791702315305498600510386796572794213",
                "281185031991957870375503044512903737552",
                "273531679647203249344782023591675532414",
                "11066813988941769770638659142924321196",
                "319315509107053480197575825093538176520",
                "160897531456351311476597464234799193426",
                "94667174876049683382792163495807874065"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-102554-f2d3620c",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe",
        "target": {
            "file": "guava-tests/test/com/google/common/collect/CompactHashSetTest.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "20844557412769902748216963438585814676",
                "72419251582803430013834669186547251320",
                "150407209162837196683988779215433356241",
                "95443147109136191844975213298223163606",
                "211111964663615221813888094187816102815",
                "57259815959556124625734628440700458788",
                "55730995002479030752135168310537277791",
                "118894388676256217080940525446444461346",
                "43757446850151211962677717556247263725",
                "235794854518735083966017557084635419995",
                "149819526429080839920868251802347539925",
                "321718743850617423320635728919603529748"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-102554-ff05c3bf",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe",
        "target": {
            "file": "android/guava-tests/test/com/google/common/collect/CompactHashMapTest.java"
        }
    }
]
vanir_signatures_modified 
"2026-10-11T07:05:35Z"