Threats tagged 'ghsa-xxph-c9ww-hj94'

Google Guava versions from 4.0 up to but not including 33.7.2 contain a deserialization vulnerability in CompactHashMap, CompactHashSet, and MapMakerInternalMap. These classes read an attacker-controlled size value from a serialized stream without proper upper bound validation, leading to uncontrolled memory allocation. This can cause the Java Virtual Machine (JVM) to allocate multi-gigabyte arrays and crash with an OutOfMemoryError, even when the serialized data contains only a small number of actual elements.