Cette page suit l'état du correctif pour Ubuntu. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2026-102554 →
UBUNTU-CVE-2026-102554
Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows a...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Ubuntu:14.04:LTS
guava-libraries
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:16.04:LTS
guava-libraries
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:18.04:LTS
guava-libraries
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:20.04:LTS
guava-libraries
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:22.04:LTS
guava-libraries
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:24.04:LTS
guava-libraries
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.10
guava-libraries
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.04:LTS
guava-libraries
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Références
- report ubuntu.com
- report cve.org
- report github.com/google/guava
- report github.com/google/guava/commit/a0d0c36432c4cc7aa4b5063bab9f20d3d18fe9fc
- report github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe
- report github.com/google/guava/security/advisories/ghsa-xxph-c9ww-hj94
- report bugs.debian.org
- report security-tracker.debian.org/tracker/cve-2026-102554
- report github.com/cveproject/cvelistv5/tree/main/cves/2026/102xxx/cve-2026-102554.json
- report github.com/google/guava/releases/tag/v33.7.2
- report nvd.nist.gov/vuln/detail/cve-2026-102554