This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-102554 →
UBUNTU-CVE-2026-102554
Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows a...
Original description
The description as published by the source.
Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Ubuntu:14.04:LTS
guava-libraries
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:16.04:LTS
guava-libraries
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:18.04:LTS
guava-libraries
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:20.04:LTS
guava-libraries
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:22.04:LTS
guava-libraries
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:24.04:LTS
guava-libraries
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.10
guava-libraries
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.04:LTS
guava-libraries
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
References
- report ubuntu.com
- report cve.org
- report github.com/google/guava
- report github.com/google/guava/commit/a0d0c36432c4cc7aa4b5063bab9f20d3d18fe9fc
- report github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe
- report github.com/google/guava/security/advisories/ghsa-xxph-c9ww-hj94
- report bugs.debian.org
- report security-tracker.debian.org/tracker/cve-2026-102554
- report github.com/cveproject/cvelistv5/tree/main/cves/2026/102xxx/cve-2026-102554.json
- report github.com/google/guava/releases/tag/v33.7.2
- report nvd.nist.gov/vuln/detail/cve-2026-102554