CVE-2026-102554: Google Guava CompactHashMap/CompactHashSet deserialization DoS

CVE-2026-102554 · Severity: medium · CVSS 5.9 · Published 2026-10-27

Google Guava's CompactHashMap, CompactHashSet, and related collection classes contain a deserialization flaw that allows attackers to trigger massive uncontrolled memory allocation, crashing Java applications. A malicious 72-byte input can force multi-gigabyte heap allocations and cause denial of service, affecting any application that deserializes untrusted data with Guava on its classpath.

Technologies: com.google.guava:guava (Maven). Vendors: Google, Maven.

Quick answers

Is CVE-2026-102554 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-102554 being exploited in the wild.
How severe is CVE-2026-102554?
Medium severity, with a CVSS score of 5.9, published 27 October 2026.
Which products and versions are affected?
Google Guava all versions up to at least 33.7.1-jre and 33.7.1-android; com.google.guava:guava (Maven) >= 4.0, <= 33.7.1, ECOSYSTEM:introduced=4.0,fixed=33.7.2.
Is there a fix for CVE-2026-102554?
Yes. com.google.guava:guava (Maven): upgrade to 33.7.2 or later. Until then: Disable deserialization of untrusted data. If deserialization of Guava collections is necessary, implement strict serialization filters or use a whitelist of allowed classes to prevent ObjectInputStream from instantiating CompactHashMap, CompactHashSet, MapMakerInternalMap, and their variants. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-102554 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-102554?
Check whether you run Google Guava or com.google.guava:guava (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • com.google.guava:guava (Maven): upgrade to 33.7.2 or later
    # set com.google.guava:guava to 33.7.2 in your pom.xml or build.gradle

Disable deserialization of untrusted data. If deserialization of Guava collections is necessary, implement strict serialization filters or use a whitelist of allowed classes to prevent ObjectInputStream from instantiating CompactHashMap, CompactHashSet, MapMakerInternalMap, and their variants.

Technical details

The vulnerability exists in the readObject() methods of CompactHashMap, CompactHashSet, CompactLinkedHashMap, CompactLinkedHashSet, and MapMakerInternalMap, which read an attacker-controlled elementCount or initialCapacity field from the serialized stream and allocate backing arrays at that full size before validating the actual stream content. On the first insertion or during deserialization, arrays sized up to 2^30-1 (~1.07 billion elements) are eagerly allocated, causing extreme memory amplification. This is reachable via native Java deserialization (ObjectInputStream.readObject()) with no special preconditions beyond Guava being present on the classpath.

Affected products

  • Google Guava all versions up to at least 33.7.1-jre and 33.7.1-android

Identifiers

  • CVE-2026-102554
  • GHSA-xxph-c9ww-hj94

Timeline

  • 2026-10-27: disclosed
  • other: CVE-2026-102554 assigned

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.