CLEANSTART-2026-UK97586: Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4
Security vulnerability affects the sonarqube package. Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/sonarqubeto a version that resolves this vulnerability.Fixed in 26.9.0.129388-r1
Event History
Frequently Asked Questions
What exposure conditions are indicated by the severity vector?
The vector indicates network-based exploitation with no privileges or user interaction required. It also indicates that an additional attack requirement is present, but the advisory does not specify what that requirement is.
What security impact is identified?
The advisory rates the issue high at 8.2 and identifies a high availability impact. It does not indicate confidentiality or integrity impact.
Can the affected SonarQube package versions be determined from this advisory?
No. The advisory identifies cleanstart/sonarqube and references Google Guava version 4, but it does not provide affected or fixed SonarQube package versions.