CVE-2026-102554

Executive Summary

CVE-2026-102554 is a resource-exhaustion vulnerability in Google Guava versions 4.0 through 33.7.1. During Java object deserialization, Guava eagerly allocates arrays for CompactHashMap, CompactHashSet, and MapMakerInternalMap instances based on a caller-specified size parameter without enforcing limits or throttling. An attacker able to supply a crafted serialization stream can force excessive memory allocation, resulting in a java.lang.OutOfMemoryError and a denial-of-service condition affecting any application that deserializes untrusted Java objects with the impacted Guava classes on its classpath.

Technical Analysis

The vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling) and is mapped here to CWE-502 (Deserialization of Untrusted Data). The core mechanism is straightforward: Guava's CompactHashMap, CompactHashSet, and MapMakerInternalMap implementations reconstruct internal backing arrays during deserialization. The size of these arrays is derived from a value carried inside the serialized stream itself. Because no upper bound or throttle is applied at reconstruction time, an attacker who controls the bytes of a serialized object can specify an arbitrarily large size value. Guava will attempt to allocate an array of that magnitude immediately, before any meaningful validation of the actual data volume.

This is a classic "deserialization amplification" pattern. The attacker does not need to transmit gigabytes of payload over the network; the serialized size field is small, but its declared value drives a disproportionate allocation on the victim JVM heap. If the requested allocation exceeds available heap, the JVM throws OutOfMemoryError. Depending on how the host application handles that error, the outcome ranges from a failed request to a crashed worker thread, a hung request handler, or full JVM termination.

The attack surface is any component that deserializes Java objects originating from an untrusted source, including but not limited to network RPC endpoints, message-queue consumers, cache-entry deserialization, session replication mechanisms, and any file or blob ingestion path that reconstructs Java objects. The vulnerability does not require authentication and does not require user interaction: it is triggered purely by the content of the deserialized stream. No public proof-of-concept, Nuclei template, or exploit code is currently associated with this CVE in the provided intelligence. Because the allocation size is caller-controlled and validated only by the JVM's memory limits, repeated triggering can be leveraged to sustain denial of service.

Exploitation Scenarios

Because no public PoC exists, the attack chain below is described at the vulnerability-class level and inferred strictly from the NVD description. No specific function names, endpoints, or parameters beyond those named in the description are asserted.

1. Reconnaissance / target identification. The attacker identifies an application or service that (a) uses Guava in the affected range and (b) deserializes Java objects from an untrusted or semi-trusted source. Candidate surfaces include RPC/remoting endpoints, message brokers consuming serialized Java payloads, blob/file ingestion pipelines, and Java serialization-based session or cache mechanisms.

2. Triggering the flaw class. The attacker crafts a serialization stream containing a CompactHashMap, CompactHashSet, or MapMakerInternalMap object whose embedded size parameter is set to an extreme value. This leverages CWE-770 (allocation without limits or throttling) during the deserialization path described.

3. Payload / execution method. The crafted stream is delivered through whatever channel the target uses to accept serialized objects. On deserialization, Guava attempts to eagerly allocate a backing array sized per the attacker-supplied parameter, exhausting heap. The attacker needs no code-execution primitive; the memory allocation itself is the weapon.

4. Post-exploitation impact. Successful triggering produces OutOfMemoryError, degrading or halting the affected service. Repeated delivery sustains the denial-of-service. In shared JVM deployments the blast radius may extend to co-hosted services.

Note: No public PoC is available; this attack chain is inferred from the described vulnerability class.

Impact Assessment

Successful exploitation yields a denial-of-service condition via heap exhaustion. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H indicates a network-reachable, low-complexity attack requiring no privileges and no user interaction, with high impact limited to availability and no impact to confidentiality or integrity. Business impact includes service unavailability, failed transactions, SLA breaches, and potential cascade failures where the affected JVM hosts multiple workloads. Because Guava is an extremely widely embedded library, the set of potentially affected systems is large, but only those that deserialize untrusted Java objects using the named classes are directly triggerable. Blast radius within a single affected process is high; cross-system blast radius depends on architectural coupling and whether the affected JVM is a shared or centralized component.

Detection Guidance

Sigma Rule

title: Potential Guava Deserialization Memory Exhaustion (CVE-2026-102554)
id: 8f2c1a44-guava-dos-2026
status: experimental
description: Detects OutOfMemoryError events potentially linked to Guava CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization abuse.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102554
author: valtersit.com
logsource:
  category: application
  product: java
detection:
  selection_error:
    message|contains:
      - 'java.lang.OutOfMemoryError'
  selection_class:
    message|contains:
      - 'CompactHashMap'
      - 'CompactHashSet'
      - 'MapMakerInternalMap'
  condition: selection_error and selection_class
falsepositives:
  - Legitimate large object deserialization in trusted internal flows
level: medium

YARA Rule

rule CVE_2026_102554_Guava_Deserialization_DoS
{
    meta:
        description = "Detects Java serialized streams referencing Guava CompactHashMap/CompactHashSet/MapMakerInternalMap"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102554"
        date = "2026-01-01"
    strings:
        $magic = { AC ED 00 05 }
        $g1 = "com.google.common.collect.CompactHashMap" ascii
        $g2 = "com.google.common.collect.CompactHashSet" ascii
        $g3 = "com.google.common.collect.MapMakerInternalMap" ascii
    condition:
        $magic at 0 and any of ($g*)
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-102554 Guava Deserialization Class Reference Detected"; flow:to_server,established; content:"|AC ED 00 05|"; content:"com.google.common.collect.CompactHash"; nocase; distance:0; classtype:attempted-dos; sid:2026102554; rev:1;)

Elastic Detection

// Detect JVM OutOfMemoryError events concurrent with Guava Map/Set deserialization
logs-java.application* and event.category: "process"
| where process.error.message like "*OutOfMemoryError*"
| where process.error.message like "*CompactHash*" or process.error.message like "*MapMakerInternalMap*"

Splunk SPL Query

index=java_logs (message="*OutOfMemoryError*") ("CompactHashMap" OR "CompactHashSet" OR "MapMakerInternalMap")
| stats count min(_time) as first_seen max(_time) as last_seen by host, source
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="java,CVE-2026-102554,">
  <rule id="2026102" level="10">
    <decoded_as>json</decoded_as>
    <field name="message">OutOfMemoryError</field>
    <regex>CompactHashMap|CompactHashSet|MapMakerInternalMap</regex>
    <description>CVE-2026-102554: Possible Guava deserialization memory exhaustion (Java OutOfMemoryError)</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations.

   • Enable Java deserialization filtering (jdk.serialFilter or an equivalent allow-list/deny-list mechanism) to reject deserialization of the affected Guava classes from untrusted sources. This is the most direct control given the absence of a patch.
   • Apply JVM heap limits and container memory limits to bound the damage of any single allocation attempt.
   • Terminate or isolate any service that must deserialize untrusted Java objects, particularly network-facing RPC/remoting endpoints.
   • Disable Java native serialization entirely on components that do not require it.

2. Patch / upgrade steps.

   • No fixed version is identified in the provided intelligence. Track Guava release notes and the official vulnerability advisory for a version that introduces array-size throttling/allocation limits during deserialization, then upgrade immediately when published. Do not rely on unverified version claims.

3. Long-term hardening.

   • Migrate away from Java native serialization toward typed, schema-validated formats (e.g., JSON/protobuf) that do not reconstruct arbitrary collections from attacker-controlled stream headers.
   • Enforce strict input validation and size bounds at all deserialization boundaries.
   • Inventory where Guava classes are present and specifically where CompactHashMap, CompactHashSet, and MapMakerInternalMap may be reconstructed from external data.
   • Continuously monitor the NVD record and the Guava project for patch release and CISA KEV status changes.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102554
• Google Guava project (releases / security advisories): https://github.com/google/guava
• CWE-770 — Allocation of Resources Without Limits or Throttling: https://cwe.mitre.org/data/definitions/770.html
• CWE-502 — Deserialization of Untrusted Data: https://cwe.mitre.org/data/definitions/502.html
• CISA Known Exploited Vulnerabilities Catalog (not currently listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence are currently associated with this CVE.