RHLW-2026-688eb055fb69a082: Lightwell Security Advisory: guava 32.1.2.jre-rhlw-00001
Red Hat Lightwell has released com.google.guava:guava 32.1.2.jre-rhlw-00001 with a backported security fix.
CVE-2026-102554: Denial of Service via Eager Array Allocation During Deserialization in Guava
This patched artifact is a drop-in replacement for com.google.guava:guava 32.1.2.jre from Maven Central.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
red-hat-lightwell/com.google.guava:guavato a version that resolves this vulnerability.Fixed in 32.1.2.jre-rhlw-00001 - Upgrade
Upgrade
com.google.guava:guavato a version that resolves this vulnerability.Fixed in 32.1.2.jre-rhlw-00001
Event History
Frequently Asked Questions
Which Guava artifact should be used to remediate this issue?
Use Red Hat Lightwell's com.google.guava:guava 32.1.2.jre-rhlw-00001 artifact. It includes a backported security fix and is a drop-in replacement for com.google.guava:guava 32.1.2.jre from Maven Central.
What impact does this vulnerability have?
The issue can cause a denial of service through eager array allocation during deserialization. The provided vector indicates network reachability, no required privileges or user interaction, and impact limited to availability.
Is exploitation straightforward?
The supplied severity vector rates attack complexity as high. No privileges or user interaction are required according to that vector.