CVE-2026-102554

{
  "etk_id": "ETK-2026-1083",
  "cve_id": "CVE-2026-102554",
  "display_id": "CVE-2026-102554",
  "ghsa_id": "GHSA-xxph-c9ww-hj94",
  "euvd_id": "EUVD-2026-95889",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unbounded deserialization allocation in Google Guava",
  "summary": "Google Guava versions 4.0 through 33.7.1 are affected by unbounded array allocation while deserializing certain map implementations. An attacker able to supply crafted Java serialized data for processing can exhaust memory and cause a denial of service.",
  "mitigation": "Upgrade Guava to version 33.7.2 or later. Until upgraded, avoid deserializing untrusted Java serialized data.",
  "vendor": "Google",
  "product": "Guava",
  "affected": [
    {
      "affected_notes": [
        "4.0–33.7.1"
      ],
      "affected_ranges": [],
      "ecosystem": "maven",
      "fixed_versions": [
        "33.7.2"
      ],
      "package_name": "com.google.guava:guava",
      "purl": "pkg:maven/com.google.guava/guava"
    }
  ],
  "cwes": [
    770
  ],
  "cvss_score": 8.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.0035,
  "epss_percentile": 0.2738,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 12.510145883333333,
  "t0_at": "2026-10-09T15:07:16.130000+00:00",
  "signals": {
    "public_poc": {
      "at": "2026-09-29T14:31:05+00:00",
      "days": -10.025128819444445,
      "is_lower_bound": false,
      "measured_at": "2026-10-09T15:07:16.130000+00:00",
      "url": "https://github.com/google/guava/security/advisories/GHSA-xxph-c9ww-hj94"
    },
    "trigger_signal": {
      "at": "2026-10-09T15:07:16.130000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-09T15:07:16.130000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-102554"
    }
  }
}