Skip to content
OpenAdvisories
High RHSA-2026:99091 1 CVE

Red Hat Security Advisory: guava security update

Published Nov 13, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 3

ReleasePackageFixed in
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 guava 0:32.1.3-6.el10_2.1
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 guava-javadoc 0:32.1.3-6.el10_2.1
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 guava-testlib 0:32.1.3-6.el10_2.1

Vulnerabilities 1

  • High 8.2
    CVE-2026-102554

    Denial of Service via Eager Array Allocation During Deserialization in Guava

    Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashS…

    Google Guava druid thingsboard-tb-node Debian Ubuntu Azure Linux Wolfi Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2548685
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_99091.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-102554
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-102554
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-102554
  • article
    https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe
  • article
    https://github.com/google/guava/releases/tag/v33.7.2
  • article
    https://github.com/google/guava/security/advisories/GHSA-xxph-c9ww-hj94