{"id":"CVE-2026-102554","kind":"vulnerability","aliases":["CVE-2026-102554","GHSA-xxph-c9ww-hj94"],"related":[],"title":"Google Guava: CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocation","description":"# CompactHashMap/CompactHashSet/MapMakerInternalMap native deserialization triggers uncontrolled memory allocation\n\n## Summary\n\n`CompactHashMap`, `CompactHashSet`, and `MapMakerInternalMap` implement `readObject(ObjectInputStream)` by reading an attacker-controlled `elementCount` or `initialCapacity` from the stream. On the very first insertion during or after deserialization (for the `CompactHash*` collections, inside `allocArrays()`) or immediately during deserialization (for `MapMakerInternalMap`), the implementation eagerly allocates arrays sized to that full, unvalidated value (up to `CompactHashing.MAX_SIZE` = 2^30-1, ~1.07 billion, for example) before the rest of the stream's actual content has been consumed. A 72-byte malicious serialized stream containing a single tiny element can force a multi-gigabyte allocation and crash a JVM with `OutOfMemoryError`, dynamically confirmed against the current release.\n\n## Details\n\n`CompactHashMap.readObject()` (`guava/src/com/google/common/collect/CompactHashMap.java`):\n\n```java\nprivate void readObject(ObjectInputStream stream) throws IOException, ClassNotFoundException {\n  stream.defaultReadObject();\n  int elementCount = stream.readInt();\n  if (elementCount < 0) {\n    throw new InvalidObjectException(\"Invalid size: \" + elementCount);\n  }\n  init(elementCount);\n  for (int i = 0; i < elementCount; i++) {\n    K key = (K) stream.readObject();\n    V value = (V) stream.readObject();\n    put(key, value);\n  }\n}\n```\n\n`elementCount` is only checked for being non-negative; there is no upper bound and no relationship enforced between the declared count and how much data actually follows in the stream. `init(elementCount)` (line 251) just stores the value (clamped to `[1, CompactHashing.MAX_SIZE]`, i.e. up to 2^30-1):\n\n```java\nvoid init(int expectedSize) {\n  Preconditions.checkArgument(expectedSize >= 0, \"Expected size must be >= 0\");\n  this.metadata = Ints.constrainToRange(expectedSize, 1, CompactHashing.MAX_SIZE);\n}\n```\n\nThe real allocation is deferred to `allocArrays()`, which fires lazily on the *first* `put()` call — i.e. after only one key/value pair has actually been read off the wire:\n\n```java\nint allocArrays() {\n  ...\n  int expectedSize = metadata;\n  int buckets = CompactHashing.tableSize(expectedSize);\n  this.table = CompactHashing.createTable(buckets);\n  setHashTableMask(buckets - 1);\n  this.entries = new int[expectedSize];\n  this.keys = new Object[expectedSize];\n  this.values = new Object[expectedSize];\n  return expectedSize;\n}\n```\n\nWith `expectedSize` near `CompactHashing.MAX_SIZE` (2^30-1), this single call allocates a hash `table` plus three `expectedSize`-length arrays — multiple gigabytes — triggered by a stream that has, at that point, only supplied one small real element. `CompactHashSet.readObject()`/`allocArrays()` have the identical shape. `CompactLinkedHashMap`/`CompactLinkedHashSet` extend these classes and inherit the same unguarded path.\n\nThe problem with `MapMakerInternalMap` is similar, with [a size read from the serialized data and stored in a `MapMaker` instance](https://github.com/google/guava/blob/1278ad9c2257f48dc82fb7b7c625ab563605aa24/guava/src/com/google/common/collect/MapMakerInternalMap.java#L2848-L2851) for [later user during deserialization](https://github.com/google/guava/blob/1278ad9c2257f48dc82fb7b7c625ab563605aa24/guava/src/com/google/common/collect/MapMakerInternalMap.java#L2897), when [the `MapMaker` is passed back to `MapMakerInternalMap`](https://github.com/google/guava/blob/1278ad9c2257f48dc82fb7b7c625ab563605aa24/guava/src/com/google/common/collect/MapMaker.java#L287) and [segments are allocated](https://github.com/google/guava/blob/1278ad9c2257f48dc82fb7b7c625ab563605aa24/guava/src/com/google/common/collect/MapMakerInternalMap.java#L173-L200) by [calling `newSegment`](https://github.com/google/guava/blob/1278ad9c2257f48dc82fb7b7c625ab563605aa24/guava/src/com/google/common/collect/MapMakerInternalMap.java#L1143), whose implementations ([example](https://github.com/google/guava/blob/1278ad9c2257f48dc82fb7b7c625ab563605aa24/guava/src/com/google/common/collect/MapMakerInternalMap.java#L443)) create `Segment` instances ([example](https://github.com/google/guava/blob/1278ad9c2257f48dc82fb7b7c625ab563605aa24/guava/src/com/google/common/collect/MapMakerInternalMap.java#L2019)) that [allocate arrays of the requested capacity](https://github.com/google/guava/blob/1278ad9c2257f48dc82fb7b7c625ab563605aa24/guava/src/com/google/common/collect/MapMakerInternalMap.java#L1234) through [the `newTable`](https://github.com/google/guava/blob/1278ad9c2257f48dc82fb7b7c625ab563605aa24/guava/src/com/google/common/collect/MapMakerInternalMap.java#L1262) helper.\n\nThis is the same amplification shape as the already-fixed **CVE-2018-10237** (`AtomicDoubleArray`/`CompoundOrdering`: attacker declares a large size, library eagerly allocates before validating against actual stream content). That fix rewrote `AtomicDoubleArray.readObject()` to grow an `ImmutableLongArray.Builder` incrementally per element actually read, rather than pre-allocating from the declared size — Guava's own `HashBiMap.readObject()` documents the same defensive principle explicitly in a comment: `init(16); // resist hostile attempts to allocate gratuitous heap`. `CompactHashMap`/`CompactHashSet` do not follow either of these two patterns already present elsewhere in the same codebase.\n\n**Reachability**: All classes are top-level, `implements ... Serializable`, and require no special classpath setup beyond Guava being present (near-ubiquitous on JVM backends). A native Java deserialization attacker names the class directly in a hand-crafted stream — no particular Guava factory method needs to have been used by the victim application, exactly as with the precedent CVE.\n\n## PoC\n\nFull source and run instructions in the attached `poc-guava-compacthash-dos.zip` (Maven project, `guava:33.7.1-jre` — the current latest release — as the only dependency). The PoC:\n\n1. Uses reflection only to legitimately obtain a `CompactHashSet` instance (it is package-private; a real attacker does not need this step, since they craft the serialized bytes directly rather than calling Guava's own serialization code).\n2. Serializes one set with 1 element and one with 2 elements, diffs the two byte streams to locate the exact offset of the `elementCount` field (byte-precise, not guessed).\n3. Patches that one 4-byte field in the 1-element stream from `1` to `0x3FFFFFFF` (`CompactHashing.MAX_SIZE`), leaving the rest of the 72-byte stream (one real `\"A\"` element) untouched.\n4. Feeds the resulting 72-byte malicious stream into a plain `new ObjectInputStream(...).readObject()` call against the real, unmodified `guava-33.7.1-jre.jar`.\n\nActual run output:\n\n```\n### -Xmx8g (generous heap) ###\nLocated size field at offset 63, value=1 (expected 1)\nMalicious stream size: 72 bytes\nDeclared elementCount: 1073741823 (~1.07 billion)\nReal payload: 1 tiny string element (\"A\")\n=== RESULT ===\nException: java.lang.OutOfMemoryError: Java heap space\nTime to allocate+fail: 4013 ms\nHeap used before: 3 MB\nHeap used after (at failure point): 4103 MB\nJVM max heap (-Xmx): 8192 MB\n\n### -Xmx128m (ordinary service-sized heap) ###\nLocated size field at offset 63, value=1 (expected 1)\nMalicious stream size: 72 bytes\nDeclared elementCount: 1073741823 (~1.07 billion)\nReal payload: 1 tiny string element (\"A\")\n=== RESULT ===\nException: java.lang.OutOfMemoryError: Java heap space\nTime to allocate+fail: 24 ms\nHeap used before: 4 MB\nHeap used after (at failure point): 2 MB\nJVM max heap (-Xmx): 128 MB\n```\n\nA 72-byte input forces ~4.1 GB of real allocation before failing on an 8 GB heap, and crashes a 128 MB heap in 24 ms — over 50,000x amplification between input size and forced allocation.\n\nTo reproduce: `mvn -q compile dependency:build-classpath -Dmdep.outputFile=cp.txt && java -Xmx128m -cp \"target/classes:$(cat cp.txt)\" poc.Poc`\n\n## Impact\n\nUncontrolled resource consumption (CWE-770 / CWE-400) via native Java deserialization: any application that runs `ObjectInputStream.readObject()` on data reachable by an attacker, and has Guava on its classpath (true for a large fraction of the JVM ecosystem), can be crashed with a single ~72-byte payload, regardless of what type the application itself expected to deserialize.\n\n## Severity\n\nCVSS 3.1: `AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H` — identical vector to CVE-2018-10237, the precedent this is a sibling of. Recomputed with the full formula: exploitability = 8.22×0.85×0.44×0.85×0.85 = 2.221; ISS = 1-(1×1×0.44) = 0.56; impact = 6.42×0.56 = 3.595; base = roundup(5.816) = **5.9 (Medium)**.\n\n## Affected\n\n`com.google.guava:guava`, all editions (`-jre`/`-android`) — confirmed on the current latest release, 33.7.1-jre. `CompactHashMap`/`CompactHashSet`/`CompactLinkedHashMap`/`CompactLinkedHashSet` have had this same `readObject`/`allocArrays` shape for a long time (probably since they were added in Guava 23.6), and similarly for `MapMakerInternalMap` (which was introduced in Guava 4.0); not tested against older individual releases.\n\n## Suggested fix\n\nApply the same defense already used elsewhere in this codebase: either clamp the initial `init()` capacity to a small constant regardless of the declared `elementCount` (as `HashBiMap.readObject()` already does — `init(16); // resist hostile attempts to allocate gratuitous heap`) and grow incrementally as elements are actually read, or grow the backing arrays incrementally per iteration of the deserialization loop (as the fixed `AtomicDoubleArray.readObject()` does via `ImmutableLongArray.Builder`) instead of eagerly sizing to the full attacker-declared count on first insert.","summary":"Guava's CompactHashMap, CompactHashSet and MapMakerInternalMap read an element count from a serialized stream and allocate arrays sized to it before the real data is read. A roughly 72-byte crafted stream can make a JVM throw OutOfMemoryError and crash.","severity":"high","cvss":8.2,"epss":0.00352,"exploited":false,"exploited_at":null,"products":[{"name":"com.google.guava:guava","fixed":["33.7.2"],"affected":">= 4.0, <= 33.7.1","ecosystem":"maven"}],"ecosystems":["maven"],"tags":["cwe-400","cwe-502","cwe-770","guava","java","jvm","maven","package","self-hosted"],"not_affected_if":["no-untrusted-java-deserialization"],"how_to_check":"- Run `mvn dependency:tree` or `gradle dependencies` and look for `com.google.guava:guava` at a version at or below `33.7.1`\n- Search the application for `ObjectInputStream` calls that read data an attacker can reach","fix":"- Upgrade `com.google.guava:guava` to `33.7.2`\n- Until upgraded, avoid native Java deserialization of untrusted data","status":"open","published_at":"2026-10-09T16:17:20+00:00","first_seen_at":"2026-10-27T14:32:22+00:00","triaged_at":"2026-10-27T14:33:09+00:00","updated_at":"2026-10-27T15:02:22+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-27T14:33:09Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `com.google.guava:guava` to `33.7.2`\n- Until upgraded, avoid native Java deserialization of untrusted data","reach":"network","title":"Guava: crafted Java serialization data forces huge memory allocation and crash","impact":"medium","summary":"Guava's CompactHashMap, CompactHashSet and MapMakerInternalMap read an element count from a serialized stream and allocate arrays sized to it before the real data is read. A roughly 72-byte crafted stream can make a JVM throw OutOfMemoryError and crash.","category":"package","nicknames":[],"who_cares":["java","jvm","guava","maven","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Remote attacker crashes the JVM with a single small serialized payload","analyst_note":"","how_to_check":"- Run `mvn dependency:tree` or `gradle dependencies` and look for `com.google.guava:guava` at a version at or below `33.7.1`\n- Search the application for `ObjectInputStream` calls that read data an attacker can reach","needs_analyst":false,"not_affected_if":["no-untrusted-java-deserialization"],"who_is_affected":"Applications that call ObjectInputStream.readObject() on data an attacker can send, and have Guava on the classpath, which is common across the JVM ecosystem. Services that never deserialize untrusted Java objects are much less exposed; the sources do not say whether Guava's own serialized collections are needed for normal operation.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.001011,"input_tokens":7306,"output_tokens":561,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-1':141C,282C,367C '-102554':11A,19A '-2026':10A,18A '-400':23B '-502':25B '-770':27B '/google/guava/blob/1278ad9c2257f48dc82fb7b7c625ab563605aa24/guava/src/com/google/common/collect/mapmaker.java#l287)':455C '/google/guava/blob/1278ad9c2257f48dc82fb7b7c625ab563605aa24/guava/src/com/google/common/collect/mapmakerinternalmap.java#l1143),':468C '/google/guava/blob/1278ad9c2257f48dc82fb7b7c625ab563605aa24/guava/src/com/google/common/collect/mapmakerinternalmap.java#l173-l200)':462C '/google/guava/blob/1278ad9c2257f48dc82fb7b7c625ab563605aa24/guava/src/com/google/common/collect/mapmakerinternalmap.java#l2848-l2851)':436C '/google/guava/blob/1278ad9c2257f48dc82fb7b7c625ab563605aa24/guava/src/com/google/common/collect/mapmakerinternalmap.java#l2897),':444C '0':206C,218C,290C,295C '1':274C,299C,345C '1.07':142C '2':139C,280C,365C '251':267C '30':140C,281C,366C '72':64B,159C 'actual':153C,259C,324C 'alloc':8A,51B,82C,127C,175C,304C,371C,459C 'allocarray':117C,308C,332C,398C 'array':52B,128C,379C 'attack':95C 'attacker-control':94C 'back':450C 'billion':143C 'bound':246C 'bucket':337C,342C,344C 'byte':65B,160C 'c9ww':15A 'call':316C,370C,464C 'check':236C 'clamp':272C 'class':407C 'classnotfoundexcept':199C 'collect':115C 'com.google.guava':20A 'compacthash':114C 'compacthashing.createtable':341C 'compacthashing.max':137C,275C,300C,363C 'compacthashing.tablesize':338C 'compacthashmap':38B,84C 'compacthashmap.readobject':189C 'compacthashmap/compacthashset/mapmakerinternalmap':3A,76C 'compacthashset':39B,85C 'compacthashset.readobject':397C 'compactlinkedhashmap':403C 'compactlinkedhashset':404C 'confirm':183C 'consum':157C 'contain':164C 'content':154C 'control':96C 'count':45B,254C 'craft':66B 'crash':75B,177C 'current':186C 'cve':9A,17A 'cwe':22B,24B,26B 'data':59B,258C,427C 'declar':253C 'defer':306C 'deseri':4A,78C,111C,121C,441C 'detail':188C 'dynam':182C 'eager':126C 'element':44B,168C,396C 'elementcount':97C,202C,205C,212C,214C,220C,233C,265C 'enforc':250C 'exampl':145C,471C 'expect':291C 'expecteds':287C,289C,298C,334C,339C,349C,353C,357C,359C,361C,377C 'extend':405C 'fire':310C 'first':106C,314C 'follow':260C 'forc':170C 'full':132C 'ghsa':13A 'ghsa-xxph-c9ww-hj94':12A 'gigabyt':174C,381C 'github.com':435C,443C,454C,461C,467C 'github.com/google/guava/blob/1278ad9c2257f48dc82fb7b7c625ab563605aa24/guava/src/com/google/common/collect/mapmaker.java#l287)':453C 'github.com/google/guava/blob/1278ad9c2257f48dc82fb7b7c625ab563605aa24/guava/src/com/google/common/collect/mapmakerinternalmap.java#l1143),':466C 'github.com/google/guava/blob/1278ad9c2257f48dc82fb7b7c625ab563605aa24/guava/src/com/google/common/collect/mapmakerinternalmap.java#l173-l200)':460C 'github.com/google/guava/blob/1278ad9c2257f48dc82fb7b7c625ab563605aa24/guava/src/com/google/common/collect/mapmakerinternalmap.java#l2848-l2851)':434C 'github.com/google/guava/blob/1278ad9c2257f48dc82fb7b7c625ab563605aa24/guava/src/com/google/common/collect/mapmakerinternalmap.java#l2897),':442C 'googl':1A 'guava':2A,21A,28B,36B 'guava/src/com/google/common/collect/compacthashmap.java':190C 'hash':373C 'hj94':16A 'host':35B 'i.e':277C,317C 'ident':401C 'immedi':119C 'implement':88C,125C,470C 'inherit':409C 'init':213C,264C,285C 'initialcapac':99C 'insert':107C 'insid':116C 'instanc':433C 'int':201C,216C,286C,331C,333C,336C,348C 'ints.constraintorange':297C 'invalid':210C 'invalidobjectexcept':209C 'ioexcept':198C 'java':29B,191C,283C,330C 'jvm':30B,71B,179C 'k':222C,224C 'key':223C,231C 'key/value':321C 'later':438C 'lazili':311C 'length':378C 'line':266C 'make':69B 'malici':161C 'mapmak':432C,447C 'mapmakerinternalmap':41B,87C,123C,417C,452C 'maven':31B 'memori':7A,81C 'metadata':335C 'much':257C 'multi':173C 'multi-gigabyt':172C 'multipl':380C 'must':293C 'nativ':77C 'near':362C 'negat':241C 'new':208C,347C,351C,355C 'newseg':465C 'non':240C 'non-neg':239C 'object':352C,356C 'objectinputstream':90C,195C 'one':320C,393C 'outofmemoryerror':73B,181C 'packag':32B 'pair':322C 'pass':449C 'path':413C 'plus':375C 'point':390C 'preconditions.checkargument':288C 'privat':192C 'problem':415C 'put':230C,315C 'read':42B,61B,92C,326C,423C 'readobject':89C,194C 'real':58B,303C,395C 'relationship':249C 'releas':187C 'rest':148C 'return':358C 'rough':63B 'segment':457C 'self':34B 'self-host':33B 'serial':48B,162C,426C 'sethashtablemask':343C 'shape':402C 'similar':419C 'singl':166C,369C 'size':53B,129C,138C,211C,276C,292C,301C,364C,422C 'small':394C 'store':269C,429C 'stream':49B,67B,102C,151C,163C,196C,263C,385C 'stream.defaultreadobject':200C 'stream.readint':203C 'stream.readobject':225C,229C 'summari':83C 'suppli':392C 'tabl':374C 'this.entries':346C 'this.keys':350C 'this.metadata':296C 'this.table':340C 'this.values':354C 'three':376C 'throw':72B,197C,207C 'tini':167C 'trigger':5A,79C,382C 'uncontrol':6A,80C 'unguard':412C 'unvalid':133C 'upper':245C 'user':439C 'v':226C,228C 'valu':134C,227C,232C,271C 'void':193C,284C 'whose':469C 'wire':329C 'xxph':14A","nicknames":[],"mitigations":[],"who_affected":"Applications that call ObjectInputStream.readObject() on data an attacker can send, and have Guava on the classpath, which is common across the JVM ecosystem. Services that never deserialize untrusted Java objects are much less exposed; the sources do not say whether Guava's own serialized collections are needed for normal operation.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-09T16:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-xxph-c9ww-hj94","url":"https://github.com/advisories/GHSA-xxph-c9ww-hj94","severity":"high","published_at":"2026-10-27T14:27:53+00:00","modified_at":"2026-10-27T14:27:55+00:00","first_seen_at":"2026-10-27T14:32:22+00:00","fetched_at":"2026-10-27T14:47:35+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-102554","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102554","severity":null,"published_at":"2026-10-09T16:17:20+00:00","modified_at":"2026-10-09T18:17:01+00:00","first_seen_at":"2026-10-27T15:02:22+00:00","fetched_at":"2026-10-27T15:02:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}