{"id":"ghsa-ghsa-xxph-c9ww-hj94","seq":1708828,"kind":"advisory","title":"Google Guava: CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocation","url":"https://github.com/advisories/GHSA-xxph-c9ww-hj94","permalink":"https://vulnpulse.app/items/ghsa-ghsa-xxph-c9ww-hj94","summary":"影響: maven:com.google.guava:guava >= 4.0, <= 33.7.1 → 33.7.2\nCompactHashMap/CompactHashSet/MapMakerInternalMap native deserialization triggers uncontrolled memory allocation Summary CompactHashMap, CompactHashSet, and MapMakerInternalMap implement readObject(ObjectInputStream) by reading an attacker-controlled elementCount or initialCapacity from the stream. On the very first insertion during or after deserialization (for the CompactHash collections, inside allocArrays()) or immediately during deserialization (for MapMakerInternalMap), the implementation…","severity":"high","techs":["java"],"cves":["CVE-2026-102554"],"tags":["GHSA-xxph-c9ww-hj94","com.google.guava:guava"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-27T14:27:53.000Z","fetched_at":"2026-10-27T21:03:52.214Z"}