Média · CVSS 5.9código aberto
GitHub AdvisoriesCVE-2026-102554
Google Guava: CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocation
maven · com.google.guava:guava
CompactHashMap, CompactHashSet, and MapMakerInternalMap implement readObject(ObjectInputStream) by reading an attacker-controlled elementCount or initialCapacity from the stream. On the very first insertion during or after deserialization (for the CompactHash collections, inside allocArrays()) or immediately during...