RHSA-2026:98498: Important: guava security update
Guava is a suite of core and expanded libraries that include utility classes, Google’s collections, io classes, and much much more. This project is a complete packaging of all the Guava libraries into a single jar. Individual portions of Guava can be used by downloading the appropriate module and its dependencies.Security Fix(es): com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization (CVE-2026-102554) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/guavato a version that resolves this vulnerability.Fixed in 30.1-10.el9_9.1
Event History
Frequently Asked Questions
What impact does this update address?
It addresses CVE-2026-102554, a denial-of-service issue in Guava caused by unthrottled memory allocation during deserialization.
Which software is covered by this advisory?
The advisory applies to the Red Hat Guava package identified as redhat/guava.
How severe is this advisory?
Red Hat classifies this security update as Important. The supplied data lists a risk value of 32, but does not provide a CVSS score.