CLEANSTART-2026-BX48253: Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4

Q: What access would an attacker need to exploit this issue?

The supplied CVSS vector indicates network access, low attack complexity, no required privileges, and no user interaction. It also indicates that additional attack requirements are present.

Q: What is the expected security impact?

The CVSS vector indicates a high availability impact, with no confidentiality or integrity impact identified.

Q: Can the affected or fixed package versions be determined from this advisory?

No exact affected or fixed versions of the cleanstart/sonarqube package are provided. The advisory references Google Guava version 4, but does not provide a complete version range or remediation version.

Published Nov 3, 2026

Updated

Security vulnerability affects the sonarqube package. Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.

Affected Software

1 affected componentFixes available

cleanstart/sonarqube<26.6.0.123539-r3

26.6.0.123539-r3

Event History

Nov 3, 2026

Advisory Published

via OSV·12:35 AM

Data Sourced

via OSV·12:35 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-102554

Frequently Asked Questions

What access would an attacker need to exploit this issue?

The supplied CVSS vector indicates network access, low attack complexity, no required privileges, and no user interaction. It also indicates that additional attack requirements are present.

What is the expected security impact?

The CVSS vector indicates a high availability impact, with no confidentiality or integrity impact identified.

Can the affected or fixed package versions be determined from this advisory?

No exact affected or fixed versions of the cleanstart/sonarqube package are provided. The advisory references Google Guava version 4, but does not provide a complete version range or remediation version.

CLEANSTART-2026-BX48253: Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

What access would an attacker need to exploit this issue?

What is the expected security impact?

Can the affected or fixed package versions be determined from this advisory?

Company

Resources

Contact

Frequently Asked Questions

What access would an attacker need to exploit this issue?

What is the expected security impact?

Can the affected or fixed package versions be determined from this advisory?