Google Guava: CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocation

影響: maven:com.google.guava:guava >= 4.0, <= 33.7.1 → 33.7.2

CompactHashMap/CompactHashSet/MapMakerInternalMap native deserialization triggers uncontrolled memory allocation Summary CompactHashMap, CompactHashSet, and MapMakerInternalMap implement readObject(ObjectInputStream) by reading an attacker-controlled elementCount or initialCapacity from the stream. On the very first insertion during or after deserialization (for the CompactHash collections, inside allocArrays()) or immediately during deserialization (for MapMakerInternalMap), the implementation…

Read on GitHub Advisory Database

On 10/27/2026, 11:27 PM, GitHub Advisory Database published "Google Guava: CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocation" (type: Advisory). Severity is "High" (high). Related technologies: Java. CVE: CVE-2026-102554.