Zero Radar
← feed
HighVulnerabilityCVE-2026-102554updated 27 Oct 2026, 14:28 UTC

Guava Java collections can be crashed by a tiny malicious serialized input

A specially crafted small data stream can make a Java program try to grab a huge amount of memory and crash. Anyone whose app reads untrusted serialized Java data from outside sources is at risk.

Fixed in 33.7.2Official source
SeverityHighCVSS 8.2 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yes33.7.2 · since 27 Oct 2026
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1AttackerCrafts a tiny malicious serialized stream
  2. 2Sent to appStream reaches the deserialization point
  3. 3Guava reads itTrusts the declared element count
  4. 4Huge allocationArrays sized up to about 1 billion entries
  5. 5CrashJVM throws OutOfMemoryError
  6. ResultService crashes from memory exhaustion

What happened

Guava's CompactHashMap, CompactHashSet, and MapMakerInternalMap read an unchecked element count during Java deserialization and allocate arrays sized to it before validating the rest of the stream, causing excessive memory allocation and OutOfMemoryError (CWE-789 style uncontrolled allocation).

Why it is dangerous: A roughly 72-byte crafted stream can force a multi-gigabyte allocation and crash the JVM, causing denial of service for any service that deserializes untrusted Java objects using these collections.

Are you affected?

You are affected if you use Guava versions 4.0 through 33.7.1 and deserialize Java objects (ObjectInputStream) from untrusted sources that may contain these collection types.

Package / productAffected versionsFixed in
com.google.guava:guava · maven>= 4.0, <= 33.7.133.7.2

What to do

  1. Update com.google.guava:guava to version 33.7.2 or later
  2. If you cannot update yet, avoid deserializing untrusted Java serialized data
  3. Review where your application accepts serialized Java objects from outside sources

Timeline

  1. 27 Oct 2026, 14:27 UTC
    Publicly disclosed
  2. 27 Oct 2026, 14:27 UTC
    Reported by GitHub Advisory · GitHub Advisory
  3. 27 Oct 2026, 14:28 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-102554 · GHSA-xxph-c9ww-hj94
CVSS
8.2 / 10
EPSS
0.4% chance of exploitation within 30 days
Disclosed
27 Oct 2026, 14:27 UTC
On Zero Radar
27 Oct 2026, 14:28 UTC (0 min after disclosure)
Last change
27 Oct 2026, 14:28 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Guava Java collections can be crashed by a tiny malicious serialized input · Zero Radar