CVE-2026-102554: CWE-770 Allocation of Resources Without Limits or Throttling in Google Guava

The vulnerability CVE-2026-102554 in Google Guava arises from improper handling of resource allocation during deserialization of certain data structures (CompactHashMap, CompactHashSet, MapMakerInternalMap). Guava eagerly allocates an array based on a caller-specified size parameter without applying any throttling or limits. This lack of control permits an attacker to supply maliciously crafted serialization streams that cause excessive memory allocation, leading to an OutOfMemoryError and resulting in a Denial of Service condition. The issue affects Guava versions from 4.0 up to but not including 33.7.2.

An unauthenticated attacker can exploit this vulnerability remotely to cause a Denial of Service by exhausting system memory during deserialization. This can disrupt application availability and potentially impact dependent services. There is no indication of confidentiality or integrity impact, and no known active exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the current data. Until a patch is available, consider avoiding deserialization of untrusted data or applying application-level controls to limit resource allocation during deserialization.