## Google Guava: CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocation

- 種別: advisory
- 重大度: high
- 関連技術: java
- CVE: CVE-2026-102554
- 公開日時: 2026-10-27T14:27:53.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-xxph-c9ww-hj94)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-xxph-c9ww-hj94

影響: maven:com.google.guava:guava >= 4.0, <= 33.7.1 → 33.7.2
CompactHashMap/CompactHashSet/MapMakerInternalMap native deserialization triggers uncontrolled memory allocation Summary CompactHashMap, CompactHashSet, and MapMakerInternalMap implement readObject(ObjectInputStream) by reading an attacker-controlled elementCount or initialCapacity from the stream. On the very first insertion during or after deserialization (for the CompactHash collections, inside allocArrays()) or immediately during deserialization (for MapMakerInternalMap), the implementation…