RHLW-2026-beae96651cf48d01: Lightwell Security Advisory: guava 32.0.1.jre-rhlw-00001

Q: Which Guava dependency should be replaced?

Replace com.google.guava:guava 32.0.1.jre from Maven Central with Red Hat Lightwell's com.google.guava:guava 32.0.1.jre-rhlw-00001. The Lightwell artifact is identified as a drop-in replacement.

Q: What is the impact addressed by this update?

The update addresses CVE-2026-102554, a denial-of-service issue caused by eager array allocation during deserialization in Guava. The listed impact is availability only; confidentiality and integrity are not affected.

Published Nov 12, 2026

Updated

Red Hat Lightwell has released com.google.guava:guava 32.0.1.jre-rhlw-00001 with a backported security fix.

CVE-2026-102554: Denial of Service via Eager Array Allocation During Deserialization in Guava

This patched artifact is a drop-in replacement for com.google.guava:guava 32.0.1.jre from Maven Central.

Affected Software

1 affected componentFixes available

red-hat-lightwell/com.google.guava:guava<32.0.1.jre-rhlw-00001

32.0.1.jre-rhlw-00001

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade red-hat-lightwell/com.google.guava:guava to a version that resolves this vulnerability.
Fixed in 32.0.1.jre-rhlw-00001
Upgrade
Upgrade com.google.guava:guava to a version that resolves this vulnerability.
Fixed in 32.0.1.jre-rhlw-00001

Event History

Nov 12, 2026

Advisory Published

via OSV·05:43 AM

Data Sourced

via OSV·05:43 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which Guava dependency should be replaced?