CLEANSTART-2026-PY38052: Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4
Published Nov 8, 2026
·Updated
CVE-2026-102554 affects multiple packages. Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4. See references for individual vulnerability details.
Affected Software
4 affected componentsFixes available
cleanstart/solr<10.1.0-r0
10.1.0-r0
cleanstart/gradle<9.8.2-r0
9.8.2-r0
cleanstart/gradle<7.6.6-r1
7.6.6-r1
cleanstart/maven<3.9.16-r0
3.9.16-r0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/solrto a version that resolves this vulnerability.Fixed in 10.1.0-r0 - Upgrade
Upgrade
cleanstart/gradleto a version that resolves this vulnerability.Fixed in 9.8.2-r0 - Upgrade
Upgrade
cleanstart/gradleto a version that resolves this vulnerability.Fixed in 9.8.2-r1 - Upgrade
Upgrade
cleanstart/gradleto a version that resolves this vulnerability.Fixed in 7.6.6-r1 - Upgrade
Upgrade
cleanstart/mavento a version that resolves this vulnerability.Fixed in 3.9.16-r0
Event History
Nov 8, 2026
Advisory Published
via OSV·12:37 AM
Data Sourced
via OSV·12:37 AM
DescriptionSeverityAffected Software