RHSA-2026:98602: Important: guava security update
Guava is a suite of core and expanded libraries that include utility classes, Google’s collections, io classes, and much much more. This project is a complete packaging of all the Guava libraries into a single jar. Individual portions of Guava can be used by downloading the appropriate module and its dependencies.Security Fix(es): com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization (CVE-2026-102554) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/guavato a version that resolves this vulnerability.Fixed in 32.1.3-6.el10_3.1 - Upgrade
Upgrade
redhat/guava-javadocto a version that resolves this vulnerability.Fixed in 32.1.3-6.el10_3.1 - Upgrade
Upgrade
redhat/guava-testlibto a version that resolves this vulnerability.Fixed in 32.1.3-6.el10_3.1
Event History
Frequently Asked Questions
What condition is required for exploitation?
The issue is triggered during deserialization and involves unthrottled memory allocation. Systems are exposed where Guava deserializes attacker-controlled or otherwise untrusted data.
What is the likely impact of a successful attack?
The listed impact is denial of service. Unthrottled memory allocation during deserialization can allow an attacker to exhaust available memory and disrupt the affected application.
Which Red Hat packages are covered by this advisory?
The advisory lists redhat/guava, redhat/guava-javadoc, and redhat/guava-testlib.