Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2026-102554 →
DEBIAN-CVE-2026-102554
Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows a...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
guava-libraries
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:13
guava-libraries
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:14
guava-libraries
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Références
- advisory security-tracker.debian.org