CVE-2026-102554

Overview

Guava is a set of core Java libraries from Google that includes new collection types such as multimap and multiset, immutable collections, a graph library, and utilities for concurrency, I/O, hashing, primitives, and strings. It ships in two flavors distinguished by a version suffix: a JRE flavor requiring JDK 8 or higher, and an Android flavor. It is one of the most widely used third-party dependencies on the JVM.

A denial of service vulnerability (CVE-2026-102554) has been identified in the Java deserialization of Guava's CompactHashMap, CompactHashSet and MapMakerInternalMap collections, which allows attackers to exhaust the heap and crash the JVM with an OutOfMemoryError using a tiny crafted serialized stream.

Per OWASP: The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed.

This issue affects Google Guava versions 4.0 and greater, before 33.7.2.

Details

Module Info

• Product: Google Guava
• Affected packages: com.google.guava:guava
• Affected versions: >=4.0 <33.7.2
• GitHub repository: https://github.com/google/guava
• Published packages: https://central.sonatype.com/artifact/com.google.guava/guava
• Package manager: Maven
• Fixed in:
• OSS Google Guava 33.7.2
• NES for Google Guava v31.0.3

Vulnerability Info

This Medium-severity vulnerability is found in the com.google.guava:guava package in Google Guava versions 4.0 and greater, before 33.7.2. Both the JRE and Android flavors are affected.

When a CompactHashMap or CompactHashSet is deserialized, its readObject method reads an element count from the stream and passes it straight to init. The count is only checked for being non-negative; nothing ties it to how much data actually follows:

private void readObject(ObjectInputStream stream) throws IOException, ClassNotFoundException {
  stream.defaultReadObject();
  int elementCount = stream.readInt();
  if (elementCount < 0) {
    throw new InvalidObjectException("Invalid size: " + elementCount);
  }
  init(elementCount);
  for (int i = 0; i < elementCount; i++) {
    K key = (K) stream.readObject();
    V value = (V) stream.readObject();
    put(key, value);
  }
}

init stores the value, clamped only to CompactHashing.MAX_SIZE (2^30-1), and the first put or add calls allocArrays, which eagerly allocates a hash table plus three arrays of that full size:

int allocArrays() {
  int expectedSize = metadata;
  int buckets = CompactHashing.tableSize(expectedSize);
  this.table = CompactHashing.createTable(buckets);
  setHashTableMask(buckets - 1);
  this.entries = new int[expectedSize];
  this.keys = new Object[expectedSize];
  this.values = new Object[expectedSize];
  return expectedSize;
}

MapMakerInternalMap has the same shape: its serialization proxy reads a size from the stream and hands it to MapMaker.initialCapacity in readMapMaker, and the rebuilt map allocates its segment tables at that capacity during deserialization:

MapMaker readMapMaker(ObjectInputStream in) throws IOException {
  int size = in.readInt();
  return new MapMaker()
      .initialCapacity(size)
      .setKeyStrength(keyStrength)
      .setValueStrength(valueStrength)
      .keyEquivalence(keyEquivalence)
      .concurrencyLevel(concurrencyLevel);
}

CompactLinkedHashMap and CompactLinkedHashSet inherit the same path. Because these classes are Serializable and an attacker names the class directly in a hand-crafted stream, any application that calls ObjectInputStream.readObject() on attacker-reachable data with Guava on its classpath is exposed, whatever type it expected to read. The advisory demonstrates a 72-byte stream holding a single one-character element that declares about 1.07 billion elements, forcing roughly 4 GB of allocation and an OutOfMemoryError within milliseconds on a 128 MB heap.

Mitigation

Only recent versions of Google Guava are community-supported. Only the recent community supported version will receive updates to address this issue. For more information, see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to supported versions of Google Guava.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Kaya Emre Arikan (finder)