Google Guava: CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocation

影響: maven:com.google.guava:guava >= 4.0, <= 33.7.1 → 33.7.2

CompactHashMap/CompactHashSet/MapMakerInternalMap native deserialization triggers uncontrolled memory allocation Summary CompactHashMap, CompactHashSet, and MapMakerInternalMap implement readObject(ObjectInputStream) by reading an attacker-controlled elementCount or initialCapacity from the stream. On the very first insertion during or after deserialization (for the CompactHash collections, inside allocArrays()) or immediately during deserialization (for MapMakerInternalMap), the implementation…

GitHub Advisory Databaseで読む

2026/10/27 23:27、GitHub Advisory Databaseが「Google Guava: CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocation」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「重要」(high) です。関連する技術: Java。CVE: CVE-2026-102554。