RHSA-2026:99092: Important: guava security update
Guava is a suite of core and expanded libraries that include utility classes, Google’s collections, io classes, and much much more. This project is a complete packaging of all the Guava libraries into a single jar. Individual portions of Guava can be used by downloading the appropriate module and its dependencies.Security Fix(es): com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization (CVE-2026-102554) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/guavato a version that resolves this vulnerability.Fixed in 30.1-10.el9_8.1
Event History
Frequently Asked Questions
What conditions are required for exploitation?
The issue is a denial of service caused by unthrottled memory allocation during deserialization. Exploitation therefore requires an application using Guava to deserialize attacker-controlled or otherwise untrusted data.
What is the likely impact on an affected application?
An attacker may be able to trigger excessive memory allocation during deserialization, resulting in a denial of service. The provided advisory data does not describe other impacts.