CLEANSTART-2026-NU79026: Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4

Q: Which CleanStart software packages are identified as affected?

The record lists cleanstart/wso2mi, cleanstart/elasticsearch, cleanstart/sonarqube, and cleanstart/spark-sc213-jdk17-py312.

Q: Does the record provide package-specific affected or fixed version ranges?

No. It identifies Google Guava version 4 in the vulnerability description, but does not provide affected or remediated version ranges for the listed CleanStart packages.

Published Nov 7, 2026

Updated

CVE-2026-102554 affects multiple packages. Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4. See references for individual vulnerability details.

Affected Software

9 affected componentsFixes available

cleanstart/wso2mi<4.3.0-r0

4.3.0-r0

cleanstart/wso2mi<4.4.0-r0

4.4.0-r0

cleanstart/wso2mi<4.5.0-r0

4.5.0-r0

cleanstart/spark-sc213-jdk17-py312<4.2.0-r8

4.2.0-r8

cleanstart/sonarqube<26.7.0.124771-r11

26.7.0.124771-r11

cleanstart/sonarqube<26.8.0.126808-r6

26.8.0.126808-r6

cleanstart/elasticsearch<9.5.5-r2

9.5.5-r2

cleanstart/elasticsearch<9.5.5-r3

9.5.5-r3

cleanstart/elasticsearch<9.3.8-r14

9.3.8-r14

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/wso2mi to a version that resolves this vulnerability.
Fixed in 4.3.0-r0
Upgrade
Upgrade cleanstart/wso2mi to a version that resolves this vulnerability.
Fixed in 4.4.0-r0
Upgrade
Upgrade cleanstart/wso2mi to a version that resolves this vulnerability.
Fixed in 4.5.0-r0
Upgrade
Upgrade cleanstart/spark-sc213-jdk17-py312 to a version that resolves this vulnerability.
Fixed in 4.2.0-r8
Upgrade
Upgrade cleanstart/sonarqube to a version that resolves this vulnerability.
Fixed in 26.7.0.124771-r11
Upgrade
Upgrade cleanstart/sonarqube to a version that resolves this vulnerability.
Fixed in 26.7.0.124771-r12
Upgrade
Upgrade cleanstart/sonarqube to a version that resolves this vulnerability.
Fixed in 26.8.0.126808-r6
Upgrade
Upgrade cleanstart/elasticsearch to a version that resolves this vulnerability.
Fixed in 9.5.5-r2
Upgrade
Upgrade cleanstart/elasticsearch to a version that resolves this vulnerability.
Fixed in 9.5.5-r3
Upgrade
Upgrade cleanstart/elasticsearch to a version that resolves this vulnerability.
Fixed in 9.3.8-r14
Upgrade
Upgrade cleanstart/elasticsearch to a version that resolves this vulnerability.
Fixed in 9.3.8-r15

Event History

Nov 7, 2026

Advisory Published

via OSV·12:38 AM

Data Sourced

via OSV·12:38 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-102554

Frequently Asked Questions

Which CleanStart software packages are identified as affected?

The record lists cleanstart/wso2mi, cleanstart/elasticsearch, cleanstart/sonarqube, and cleanstart/spark-sc213-jdk17-py312.

Does the record provide package-specific affected or fixed version ranges?

No. It identifies Google Guava version 4 in the vulnerability description, but does not provide affected or remediated version ranges for the listed CleanStart packages.

CLEANSTART-2026-NU79026: Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which CleanStart software packages are identified as affected?

Does the record provide package-specific affected or fixed version ranges?

Company

Resources

Contact

Frequently Asked Questions

Which CleanStart software packages are identified as affected?

Does the record provide package-specific affected or fixed version ranges?