CLEANSTART-2026-LV29506: Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4

Q: Which deployed components should be prioritized for review?

Review deployments of cleanstart/wso2is, cleanstart/rundeck, cleanstart/wso2am, cleanstart/solr, and cleanstart/keycloak, as the issue is reported to affect multiple packages.

Q: What is the impact described for this issue?

The issue can cause resource allocation without limits or throttling during Java object deserialization, resulting in an availability impact. The supplied vector indicates network attack access, low attack complexity, no privileges, and no user interaction.

Q: Does the available information identify affected or fixed package versions?

No. The provided data identifies Google Guava version 4 but does not provide affected package version ranges or fixed versions for the listed software packages.

Published Nov 11, 2026

Updated

CVE-2026-102554 affects multiple packages. Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4. See references for individual vulnerability details.

Affected Software

9 affected componentsFixes available

cleanstart/wso2is<7.0.0-r3

7.0.0-r3

cleanstart/wso2is<7.2.0-r5

7.2.0-r5

cleanstart/wso2am<4.7.0-r5

4.7.0-r5

cleanstart/solr<10.0.0-r12

10.0.0-r12

cleanstart/wso2is<7.1.0-r4

7.1.0-r4

cleanstart/wso2is<7.3.0-r8

7.3.0-r8

cleanstart/rundeck<6.3.0-r0

6.3.0-r0

cleanstart/keycloak<26.6.4-r8

26.6.4-r8

cleanstart/rundeck<6.1.0-r3

6.1.0-r3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/wso2is to a version that resolves this vulnerability.
Fixed in 7.0.0-r3
Upgrade
Upgrade cleanstart/wso2is to a version that resolves this vulnerability.
Fixed in 7.2.0-r5
Upgrade
Upgrade cleanstart/wso2am to a version that resolves this vulnerability.
Fixed in 4.7.0-r5
Upgrade
Upgrade cleanstart/solr to a version that resolves this vulnerability.
Fixed in 10.0.0-r12
Upgrade
Upgrade cleanstart/wso2is to a version that resolves this vulnerability.
Fixed in 7.1.0-r4
Upgrade
Upgrade cleanstart/wso2is to a version that resolves this vulnerability.
Fixed in 7.3.0-r8
Upgrade
Upgrade cleanstart/rundeck to a version that resolves this vulnerability.
Fixed in 6.3.0-r0
Upgrade
Upgrade cleanstart/keycloak to a version that resolves this vulnerability.
Fixed in 26.6.4-r8
Upgrade
Upgrade cleanstart/rundeck to a version that resolves this vulnerability.
Fixed in 6.1.0-r3

Event History

Nov 11, 2026

Advisory Published

via OSV·12:39 AM

Data Sourced

via OSV·12:39 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-102554

Frequently Asked Questions

Which deployed components should be prioritized for review?

Review deployments of cleanstart/wso2is, cleanstart/rundeck, cleanstart/wso2am, cleanstart/solr, and cleanstart/keycloak, as the issue is reported to affect multiple packages.

What is the impact described for this issue?

The issue can cause resource allocation without limits or throttling during Java object deserialization, resulting in an availability impact. The supplied vector indicates network attack access, low attack complexity, no privileges, and no user interaction.

Does the available information identify affected or fixed package versions?

No. The provided data identifies Google Guava version 4 but does not provide affected package version ranges or fixed versions for the listed software packages.

CLEANSTART-2026-LV29506: Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployed components should be prioritized for review?

What is the impact described for this issue?

Does the available information identify affected or fixed package versions?

Company

Resources

Contact

Frequently Asked Questions

Which deployed components should be prioritized for review?

What is the impact described for this issue?

Does the available information identify affected or fixed package versions?