Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in
    Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via
    OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances,
    Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting
    memory exhaustion from crafted serialization streams. (CVE-2026-102554)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793106858 advisory.

  - Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in     Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via     OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances,     Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting     memory exhaustion from crafted serialization streams. (CVE-2026-102554)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:22143-1 advisory.

    This update for guava fixes the following issue:

    - CVE-2026-102554: Allocation of resources without limits or throttling (CWE-770) during Java object     deserialization       allows an attacker to cause a Denial of Service via OutOfMemoryError (bsc#1284985).

    Changes for guava:

    - Adapt the generated OSGi data to reality
    - Upgrade to guava 33.7.2
     * Changes of 33.7.2      + collect: Changed MapMaker, CompactHashMap, and CompactHashSet      deserialization to avoid eagerly allocating as much memory as      a serialization payload requests (bsc#1284985,      CVE-2026-102554)
     * Changes of 33.7.1      + removes the Multi-Release line from our jar manifest, fixing      an issue under Java 9 and 10 that was introduced to guava-jre      in version 33.7.0.
     * Changes of 33.7.0      + Guava module-info.class is now present at the root of the jar      instead of under a multi-release root. This prevents the jar      from containing a file at META-INF/versions/9/OSGI-INF/      /MANIFEST.MF, which occasionally causes trouble for some users      + collect: Changed some ImmutableMap implementations to create a      new, lightweight object on each call to view methods like      keySet(), rather than creating and storing that object during      the first call for reuse later. This is likely to slightly      improve performance for some users, but it could lead to      regressions in unusual cases, such as repeatedly calling      asMultimap().inverse() on the same ImmutableMap instance.
     + net: Added HttpHeaders constant for on-prefetch-activation.
     + net: Added MediaType constants for application/yaml and      application/x-pem-file.
     + util.concurrent: Fixed ExecutionSequencer queue stall when      delegate executor throws RejectedExecutionException.
     * Changes of 33.6.0      + Migrated some classes from finalize() to PhantomReference in      preparation for the removal of finalization.
     + cache: Deprecated CacheBuilder APIs that use TimeUnit in favor      of those that use Duration.
     + collect: Added toImmutableSortedMap collectors that use the      natural comparator.
     + collect: Changed ConcurrentHashMultiset, ImmutableMultimap,      and TreeMultiset deserialization to avoid mutating final      fields. In extremely unlikely scenarios in which an instance      of that type contains an object that refers back to that      instance, this could lead to a broken instance that throws      NullPointerException when used.
     + graph: Removed @Beta from all APIs in the package.
     + graph: Added support to Graphs.transitiveClosure() for      different strategies for adding self-loops.
     + graph: Added an asNetwork() view to Graph and ValueGraph.
     + hash: Added BloomFilter.serializedSize().
     + net: Added HttpHeaders.CDN_CACHE_CONTROL.
     * Changes of 33.5.0      + For users of guava-gwt: Google has moved off GWT internally.
     We plan to continue to release guava-gwt for users of GWT and      J2CL, but the artifact is no longer tested for GWT-specific      issues, and we have limited resources to fix any unexpected      issues that might arise. While we do not anticipate any      specific problems, we can't guarantee how long support will      continue.
     + Listed the JSpecify annotations as an optional dependency in      our OSGi metadata.
     + cache: Improved the handling of exceptions from compute      functions in Cache.asMap(). (We do still recommend using      Caffeine rather than com.google.common.cache.)      + collect: Improved Iterators.mergeSorted() to preserve      stability for equal elements.
     + math: Added saturatedAbs methods to IntMath and LongMath.
     + net: Added image/avif to MediaType.
     + util.concurrent: Added Striped.custom.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:24263-1 advisory.

    This update for guava fixes the following issue:

    - CVE-2026-102554: Allocation of resources without limits or throttling (CWE-770) during Java object     deserialization       allows an attacker to cause a Denial of Service via OutOfMemoryError (bsc#1284985).

    Changes for guava:

    - Adapt the generated OSGi data to reality
    - Upgrade to guava 33.7.2
     * Changes of 33.7.2      + collect: Changed MapMaker, CompactHashMap, and CompactHashSet      deserialization to avoid eagerly allocating as much memory as      a serialization payload requests (bsc#1284985,      CVE-2026-102554)
     * Changes of 33.7.1      + removes the Multi-Release line from our jar manifest, fixing      an issue under Java 9 and 10 that was introduced to guava-jre      in version 33.7.0.
     * Changes of 33.7.0      + Guava module-info.class is now present at the root of the jar      instead of under a multi-release root. This prevents the jar      from containing a file at META-INF/versions/9/OSGI-INF/      /MANIFEST.MF, which occasionally causes trouble for some users      + collect: Changed some ImmutableMap implementations to create a      new, lightweight object on each call to view methods like      keySet(), rather than creating and storing that object during      the first call for reuse later. This is likely to slightly      improve performance for some users, but it could lead to      regressions in unusual cases, such as repeatedly calling      asMultimap().inverse() on the same ImmutableMap instance.
     + net: Added HttpHeaders constant for on-prefetch-activation.
     + net: Added MediaType constants for application/yaml and      application/x-pem-file.
     + util.concurrent: Fixed ExecutionSequencer queue stall when      delegate executor throws RejectedExecutionException.
     * Changes of 33.6.0      + Migrated some classes from finalize() to PhantomReference in      preparation for the removal of finalization.
     + cache: Deprecated CacheBuilder APIs that use TimeUnit in favor      of those that use Duration.
     + collect: Added toImmutableSortedMap collectors that use the      natural comparator.
     + collect: Changed ConcurrentHashMultiset, ImmutableMultimap,      and TreeMultiset deserialization to avoid mutating final      fields. In extremely unlikely scenarios in which an instance      of that type contains an object that refers back to that      instance, this could lead to a broken instance that throws      NullPointerException when used.
     + graph: Removed @Beta from all APIs in the package.
     + graph: Added support to Graphs.transitiveClosure() for      different strategies for adding self-loops.
     + graph: Added an asNetwork() view to Graph and ValueGraph.
     + hash: Added BloomFilter.serializedSize().
     + net: Added HttpHeaders.CDN_CACHE_CONTROL.
     * Changes of 33.5.0      + For users of guava-gwt: Google has moved off GWT internally.
     We plan to continue to release guava-gwt for users of GWT and      J2CL, but the artifact is no longer tested for GWT-specific      issues, and we have limited resources to fix any unexpected      issues that might arise. While we do not anticipate any      specific problems, we can't guarantee how long support will      continue.
     + Listed the JSpecify annotations as an optional dependency in      our OSGi metadata.
     + cache: Improved the handling of exceptions from compute      functions in Cache.asMap(). (We do still recommend using      Caffeine rather than com.google.common.cache.)      + collect: Improved Iterators.mergeSorted() to preserve      stability for equal elements.
     + math: Added saturatedAbs methods to IntMath and LongMath.
     + net: Added image/avif to MediaType.
     + util.concurrent: Added Striped.custom.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in     Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via     OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances,     Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting     memory exhaustion from crafted serialization streams. (CVE-2026-102554)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
477757	Chainguard: knative-kafka-broker-fips-1.22-dispatcher-loom: security update to 1.22.3-r23	Tenable Cloud Security	Chainguard Local Security Checks	Local	high
477757	Chainguard: knative-kafka-broker-fips-1.22-dispatcher-loom: security update to 1.22.3-r23	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	high
477568	SCA: security update for com.google.guava:guava (GHSA-xxph-c9ww-hj94)	Tenable Cloud Security	SCA Checks	Local	high
477568	SCA: security update for com.google.guava:guava (GHSA-xxph-c9ww-hj94)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
372475	AlmaLinux 9.2 [TuxCare] Security Update: guava / guava-javadoc / guava-testlib (ALMALINUX9.2:CLSA-2026:1793106858)	Nessus	Alma Linux Local Security Checks	Local	high
371102	openSUSE 16 Security Update : guava (openSUSE-SU-2026:22143-1)	Nessus	SuSE Local Security Checks	Local	high
371081	SUSE SLES16 Security Update : guava (SUSE-SU-2026:24263-1)	Nessus	SuSE Local Security Checks	Local	high
364547	Linux Distros Unpatched Vulnerability : CVE-2026-102554	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-102554

high

Tenable Plugins

high

high

high

high

high

high

high

high