RHLW-2026-688eb055fb69a082
- Source
- https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-688eb055fb69a082.json
- Import Source
- https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-688eb055fb69a082.json
- JSON Data
- https://api.osv.dev/v1/vulns/RHLW-2026-688eb055fb69a082
- Upstream
- Published
- 2026-11-12T01:37:03Z
- Modified
- 2026-11-12T08:45:02Z
- Severity
-
- 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- Lightwell Security Advisory: guava 32.1.2.jre-rhlw-00001
- Details
-
Red Hat Lightwell has released com.google.guava:guava 32.1.2.jre-rhlw-00001 with a backported security fix.
CVE-2026-102554: Denial of Service via Eager Array Allocation During Deserialization in Guava
This patched artifact is a drop-in replacement for com.google.guava:guava 32.1.2.jre from Maven Central.
- References
-
- https://github.com/google/guava/releases/tag/v33.7.2
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102554.json
- https://github.com/google/guava/security/advisories/GHSA-xxph-c9ww-hj94
- https://nvd.nist.gov/vuln/detail/CVE-2026-102554
- https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe
- https://github.com/google/guava
- https://github.com/advisories/GHSA-xxph-c9ww-hj94
- Credits
-
-
- Red Hat Lightwell - REMEDIATION_DEVELOPER
-
Affected packages
Red Hat Lightwell:Maven / com.google.guava:guava
Package
- Name
- com.google.guava:guava
- Purl
- pkg:maven/com.google.guava/guava
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed32.1.2.jre-rhlw-00001
Affected versions
Other
r03
r05
r06
r07
r08
r09
10.*
10.0-rc1
10.0-rc2
10.0-rc3
10.0
10.0.1
11.*
11.0-rc1
11.0
11.0.1
11.0.2
12.*
12.0-rc1
12.0-rc2
12.0
12.0.1
13.*
13.0-rc1
13.0-rc2
13.0
13.0.1
14.*
14.0-rc1
14.0-rc2
14.0-rc3
14.0
14.0.1
15.*
15.0-rc1
15.0
16.*
16.0-rc1
16.0
16.0.1
17.*
17.0-rc1
17.0-rc2
17.0
18.*
18.0-rc1
18.0-rc2
18.0
19.*
19.0-rc1
19.0-rc2
19.0-rc3
19.0
20.*
20.0-rc1
20.0
21.*
21.0-rc1
21.0-rc2
21.0
22.*
22.0-rc1
22.0-rc1-android
22.0
22.0-android
23.*
23.0-rc1
23.0-rc1-android
23.0
23.0-android
23.1-android
23.1-jre
23.2-android
23.2-jre
23.3-android
23.3-jre
23.4-android
23.4-jre
23.5-android
23.5-jre
23.6-android
23.6-jre
23.6.1-android
23.6.1-jre
24.*
24.0-android
24.0-jre
24.1-android
24.1-jre
24.1.1-android
24.1.1-jre
25.*
25.0-android
25.0-jre
25.1-android
25.1-jre
26.*
26.0-android
26.0-jre
27.*
27.0-android
27.0-jre
27.0.1-android
27.0.1-jre
27.1-android
27.1-jre
28.*
28.0-android
28.0-jre
28.1-android
28.1-jre
28.2-android
28.2-jre
29.*
29.0-android
29.0-jre
30.*
30.0-android
30.0-jre
30.1-android
30.1-jre
30.1.1-android
30.1.1-jre
31.*
31.0-android
31.0-jre
31.0.1-android
31.0.1-jre
31.1-android
31.1-jre
32.*
32.0.0-android
32.0.0-jre
32.0.1-android
32.0.1-jre
32.1.0-android
32.1.0-jre
32.1.1-android
32.1.1-jre
32.1.2.jre
Database specific
lightwell
{
"backport_base_version": "32.1.2.jre",
"remediated_version": "32.1.2.jre-rhlw-00001",
"repository_url": "https://packages.redhat.com/lightwell/java/remediated/"
}
source
"https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-688eb055fb69a082.json"