RHSA-2026:99091: Important: guava security update
Guava is a suite of core and expanded libraries that include utility classes, Google’s collections, io classes, and much much more. This project is a complete packaging of all the Guava libraries into a single jar. Individual portions of Guava can be used by downloading the appropriate module and its dependencies.Security Fix(es): com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization (CVE-2026-102554) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/guavato a version that resolves this vulnerability.Fixed in 32.1.3-6.el10_2.1 - Upgrade
Upgrade
redhat/guava-javadocto a version that resolves this vulnerability.Fixed in 32.1.3-6.el10_2.1 - Upgrade
Upgrade
redhat/guava-testlibto a version that resolves this vulnerability.Fixed in 32.1.3-6.el10_2.1
Event History
Frequently Asked Questions
What condition is required for exploitation?
An attacker would need to cause the affected Guava software to deserialize data. The issue is an unthrottled memory allocation during deserialization, which can lead to denial of service.
Which Red Hat components are covered by this advisory?
The advisory covers redhat/guava, redhat/guava-javadoc, and redhat/guava-testlib.