Google Guava: CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocation

影響: maven:com.google.guava:guava >= 4.0, <= 33.7.1 → 33.7.2

CompactHashMap/CompactHashSet/MapMakerInternalMap native deserialization triggers uncontrolled memory allocation Summary CompactHashMap, CompactHashSet, and MapMakerInternalMap implement readObject(ObjectInputStream) by reading an attacker-controlled elementCount or initialCapacity from the stream. On the very first insertion during or after deserialization (for the CompactHash collections, inside allocArrays()) or immediately during deserialization (for MapMakerInternalMap), the implementation…

在 GitHub Advisory Database 阅读

2026/10/27 23:27，GitHub Advisory Database 发布了“Google Guava: CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocation”（类型：漏洞公告）。严重程度为“高危”（high）。相关技术：Java。CVE：CVE-2026-102554。