CVE-2026-102554: Google Guava Deserialization DoS Vulnerability

CVE-2026-102554 Overview

CVE-2026-102554 is a resource exhaustion vulnerability in Google Guava versions 4.0 through 33.7.1. The flaw resides in the Java deserialization logic of CompactHashMap, CompactHashSet, and MapMakerInternalMap. During deserialization, Guava eagerly allocates an internal array sized according to a caller-controlled size parameter without applying any throttling. An attacker who can supply a crafted serialization stream to a vulnerable application triggers an OutOfMemoryError, resulting in denial of service. The issue is tracked as CWE-770: Allocation of Resources Without Limits or Throttling, though NVD also tags it under CWE-502 because the entry point is Java object deserialization.

Critical Impact
Remote attackers can exhaust JVM heap memory and crash Java applications that deserialize untrusted data using Guava collections, with no authentication required.

Affected Products

Google Guava versions 4.0 through 33.7.1
Java applications that deserialize untrusted data into CompactHashMap or CompactHashSet
Applications that deserialize untrusted data into MapMakerInternalMap

Discovery Timeline

2026-10-09 - CVE-2026-102554 published to NVD
2026-10-09 - Last updated in NVD database
v33.7.2 - Google releases fixed Guava version via GitHub Release v33.7.2

Technical Details for CVE-2026-102554

Vulnerability Analysis

Guava's affected collection classes implement custom readObject logic for Java serialization. The deserialization routine reads an elementCount field from the input stream and calls init(elementCount) to pre-size the internal backing array before reading individual entries. Because the size value is attacker-controlled and no upper bound is enforced, a serialization payload declaring a very large element count causes the JVM to attempt immediate allocation of a large array.

The allocation succeeds in requesting heap memory even when the attacker never actually sends that many elements. This asymmetry — a few bytes on the wire triggering gigabyte-scale allocations — makes the vulnerability efficient to exploit. The result is a reliable denial of service against any Java service that passes untrusted bytes to ObjectInputStream.readObject() where the stream contains one of the affected Guava types.

Root Cause

The root cause is missing input validation on the deserialized size parameter. The pre-patch code only checked that elementCount was non-negative. It did not cap the value before using it to size an internal array. Guava's maintainers resolved this by clamping the initial allocation to a fixed ceiling and growing the collection lazily as elements are actually read.

Attack Vector

Exploitation requires the target application to deserialize attacker-controlled byte streams. Common exposure patterns include RMI endpoints, message queue consumers, HTTP endpoints that accept serialized Java objects, and caching layers that store serialized session state. The attack requires no authentication and no user interaction.

java

// Patch excerpt from CompactHashMap.java
    if (elementCount < 0) {
      throw new InvalidObjectException("Invalid size: " + elementCount);
    }
-    init(elementCount);
+    init(min(elementCount, 256));
    for (int i = 0; i < elementCount; i++) {
      K key = (K) stream.readObject();
      V value = (V) stream.readObject();

Source: Google Guava commit b931fe9

The fix caps the initial allocation at 256 slots regardless of what the serialized stream claims. The same pattern was applied to CompactHashSet:

java

// Patch excerpt from CompactHashSet.java
    if (elementCount < 0) {
      throw new InvalidObjectException("Invalid size: " + elementCount);
    }
-    init(elementCount);
+    init(min(elementCount, 256));
    for (int i = 0; i < elementCount; i++) {
      E element = (E) stream.readObject();
      add(element);

Source: Google Guava commit b931fe9

Detection Methods for CVE-2026-102554

Indicators of Compromise

Repeated java.lang.OutOfMemoryError: Java heap space entries in application logs correlated with external input processing
JVM crash dumps showing large allocations originating from CompactHashMap.readObject, CompactHashSet.readObject, or MapMakerInternalMap.readObject
Sudden heap growth followed by process termination on services that accept serialized Java objects

Detection Strategies

Inventory application dependencies for Guava versions 4.0 through 33.7.1 using Software Composition Analysis (SCA) tools such as OWASP Dependency-Check or Snyk
Instrument JVMs with heap allocation profiling to flag single allocations exceeding a defined threshold during deserialization
Deploy serialization filters via jdk.serialFilter to reject or constrain the affected Guava classes from untrusted streams

Monitoring Recommendations

Alert on repeated JVM restarts or OutOfMemoryError conditions in services that process network-sourced serialized data
Monitor network-facing Java services for anomalous spikes in request-to-memory-consumption ratio
Track dependency manifests in CI/CD pipelines to detect reintroduction of vulnerable Guava versions

How to Mitigate CVE-2026-102554

Immediate Actions Required

Upgrade Google Guava to version 33.7.2 or later across all Java applications and container images
Audit all code paths that call ObjectInputStream.readObject() on untrusted input and apply deserialization filters
Rebuild and redeploy artifacts after confirming the fixed Guava version is resolved from your dependency graph

Patch Information

The fix is available in Guava 33.7.2. See the GitHub Security Advisory GHSA-xxph-c9ww-hj94 for the official disclosure and the patch commit b931fe9 for the code changes. The patch caps initial array allocation to 256 entries in CompactHashMap, CompactHashSet, and MapMakerInternalMap.

Workarounds

Apply a JVM-wide serialization filter blocking com.google.common.collect.CompactHashMap, com.google.common.collect.CompactHashSet, and com.google.common.collect.MapMakerInternalMap from untrusted sources
Replace Java native serialization with safer formats such as JSON or Protocol Buffers for untrusted data channels
Set a strict JVM maximum heap size with -Xmx to contain blast radius, though this does not prevent the DoS condition itself

bash

# Example JVM-level deserialization filter via system property
java -Djdk.serialFilter='!com.google.common.collect.CompactHashMap;!com.google.common.collect.CompactHashSet;!com.google.common.collect.MapMakerInternalMap;maxbytes=1048576' -jar app.jar

# Maven dependency pin to the fixed version
# <dependency>
#   <groupId>com.google.guava</groupId>
#   <artifactId>guava</artifactId>
#   <version>33.7.2</version>
# </dependency>