CLEANSTART-2026-SL64169: Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4

Q: What security impact is indicated by the available severity data?

The available vector indicates high availability impact, with no indicated impact to confidentiality or integrity. Successful exploitation may therefore cause resource exhaustion or service disruption.

Q: Does an attacker need authentication or user interaction to exploit this issue?

No privileges and no user interaction are indicated, and the attack vector is network-based with low attack complexity. The vector also indicates that an additional attack requirement must be present.

Published Nov 5, 2026

Updated

Security vulnerability affects the keycloak package. Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.

Affected Software

1 affected componentFixes available

cleanstart/keycloak<26.8.1-r1

26.8.1-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/keycloak to a version that resolves this vulnerability.
Fixed in 26.8.1-r1

Event History

Nov 5, 2026

Advisory Published

via OSV·12:37 AM

Data Sourced

via OSV·12:37 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-102554

Frequently Asked Questions

What security impact is indicated by the available severity data?

The available vector indicates high availability impact, with no indicated impact to confidentiality or integrity. Successful exploitation may therefore cause resource exhaustion or service disruption.

Does an attacker need authentication or user interaction to exploit this issue?

No privileges and no user interaction are indicated, and the attack vector is network-based with low attack complexity. The vector also indicates that an additional attack requirement must be present.

CLEANSTART-2026-SL64169: Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What security impact is indicated by the available severity data?

Does an attacker need authentication or user interaction to exploit this issue?

Company

Resources

Contact

Frequently Asked Questions

What security impact is indicated by the available severity data?

Does an attacker need authentication or user interaction to exploit this issue?