CVE-2026-102554

A flaw was found in Google Guava. During Java object deserialization—the process of converting stored data back into active program objects—memory is eagerly allocated based on caller-specified size parameters without proper throttling or limits. An attacker can exploit this issue by providing a crafted serialization stream that consumes all available memory, triggering an out-of-memory error and causing a Denial of Service (DoS).

This vulnerability is rated as Important severity because an unauthenticated remote attacker can trigger memory exhaustion leading to a complete denial of service across the host Java virtual machine. Exploitation requires that an application deserializes untrusted input containing serialized Guava collection structures. In standard Red Hat product configurations, arbitrary Java object deserialization is generally restricted or not exposed to untrusted networks, which confines the attack surface to specialized deployments handling untrusted serialized data.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.