CLEANSTART-2026-CY19546: Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4
CVE-2026-102554 affects multiple packages. Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4. See references for individual vulnerability details.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/wso2amto a version that resolves this vulnerability.Fixed in 4.7.0-r4 - Upgrade
Upgrade
cleanstart/rundeckto a version that resolves this vulnerability.Fixed in 6.0.1-r11 - Upgrade
Upgrade
cleanstart/wso2mito a version that resolves this vulnerability.Fixed in 4.6.0-r10 - Upgrade
Upgrade
cleanstart/solrto a version that resolves this vulnerability.Fixed in 9.11.0-r0
Event History
Frequently Asked Questions
Which tracked software packages are associated with this issue?
The affected software entries are cleanstart/wso2am, cleanstart/rundeck, cleanstart/wso2mi, and cleanstart/solr.
What does the supplied severity vector indicate about exploitation requirements?
The vector indicates network reachability, low attack complexity, no required privileges, and no user interaction. It also indicates an attack requirement is present.
What is the expected security impact?
The vector indicates high availability impact, with no indicated confidentiality or integrity impact.
Does this record provide affected or fixed package versions?
No specific affected version ranges or fixed versions are provided in this record. It directs readers to the referenced individual vulnerability details for additional information.