Cloudanix VulnDB

CVE-2026-102554

None

CVSS

—

EPSS

0.4%

Published

Oct 9, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A widely used Java library can be tricked into using up all available memory when handling certain specially formatted data, causing programs to crash.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Unbounded array allocation during deserialization of CompactHashMap, CompactHashSet, or MapMakerInternalMap instances without size validation or throttling, resulting in OutOfMemoryError.

Why it matters to the business

Applications relying on Guava for object deserialization become unavailable or crash under load from crafted input, disrupting operations and requiring restarts or scaling.

How an attack unfolds

An attacker identifies a code path accepting untrusted serialized streams, crafts a CompactHashMap or similar instance with an excessively large size field, and transmits the payload to exhaust heap memory.

How to fix it

Upgrade Google Guava to the latest patched release beyond 33.7.1; replace or wrap all deserialization of untrusted CompactHashMap, CompactHashSet, or MapMakerInternalMap instances with safe alternatives or strict size limits.

How to confirm the fix worked

Attempt deserialization of test payloads containing large size fields against updated Guava libraries and confirm absence of OutOfMemoryError; review dependency trees for versions 4.0-33.7.1.

Typical attack path

  1. Locate application entry points performing Java deserialization of Guava collection types
  2. Generate malicious serialized object with oversized internal array length
  3. Deliver payload over network or file input to trigger eager allocation
  4. Observe process termination via OutOfMemoryError

How to detect it

Search application and JVM logs for OutOfMemoryError stack traces referencing com.google.common.collect.CompactHashMap or related classes; correlate with inbound serialized data flows.

  • com.google.common.collect.CompactHashMap
  • com.google.common.collect.CompactHashSet
  • com.google.common.collect.MapMakerInternalMap
  • java.lang.OutOfMemoryError.*Guava

What your security team should do

  • Immediately inventory all Java applications using Guava and block untrusted deserialization
  • Prioritize upgrade of Guava in any externally reachable services
  • Implement input validation or sandboxing around deserialization routines
  • Monitor dependency update channels for the official fix release

The record

Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities