Security update for guava

{
  "id": "f9f0fe3fc0be6b49ec11759506dee84284a08e0867efa4b25a79240551fce374",
  "url": "https://osv.dev/vulnerability/SUSE-SU-2026%3A24263-1",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Security update for guava",
    "summary": "This update for guava fixes the following issue: - CVE-2026-102554: Allocation of resources without limits or throttling (CWE-770) during Java object deserialization allows an attacker to cause a Denial of Service via OutOfMemoryError (bsc#1284985). Changes for guava: - Adapt the generated OSGi data to reality - Upgrade to guava 33.7.2 * Changes of 33.7.2 + collect: Changed MapMaker, CompactHashMap, and CompactHashSet deserialization to avoid eagerly allocating as much memory as a serialization payload requests (bsc#1284985, CVE-2026-102554) * Changes of 33.7.1 + removes the Multi-Release line from our jar manifest, fixing an issue under Java 9 and 10 that was introduced to guava-jre in version 33.7.0. * Changes of 33.7.0 + Guava module-info.class is now present at the root of the jar instead of under a multi-release root. This prevents the jar from containing a file at META-INF/versions/9/OSGI-INF/ /MANIFEST.MF, which occasionally causes trouble for some users + collect: Changed some ImmutableMap implementations to create a new, lightweight object on each call to view methods like keySet(), rather than creating and storing that object during the first call for reuse later. This is likely to slightly improve performance for some users, but it could lead to regressions in unusual cases, such as repeatedly calling asMultimap().inverse() on the same ImmutableMap instance. + net: Added HttpHeaders constant for on-prefetch-activation. + net: Added MediaType constants for applicati",
    "evidence": "osv:SUSE-SU-2026:24263-1",
    "products": [
      {
        "name": {
          "value": "guava",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "33.7.2-160000.1.1",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "guava",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "33.7.2-160000.1.1",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "SUSE-SU-2026:24263-1",
      "aliases": [
        "SUSE-SU-2026:24263-1"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "33.7.2-160000.1.1"
                }
              ]
            }
          ],
          "package": {
            "name": "guava",
            "purl": "pkg:rpm/suse/guava&distro=SUSE%20Linux%20Enterprise%20Server%2016.0",
            "ecosystem": "SUSE:Linux Enterprise Server 16.0"
          },
          "database_specific": {
            "source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:24263-1.json"
          },
          "ecosystem_specific": {
            "binaries": [
              {
                "guava": "33.7.2-160000.1.1",
                "guava-javadoc": "33.7.2-160000.1.1",
                "guava-testlib": "33.7.2-160000.1.1"
              }
            ]
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "33.7.2-160000.1.1"
                }
              ]
            }
          ],
          "package": {
            "name": "guava",
            "purl": "pkg:rpm/suse/guava&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0",
            "ecosystem": "SUSE:Linux Enterprise Server for SAP applications 16.0"
          },
          "database_specific": {
            "source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:24263-1.json"
          },
          "ecosystem_specific": {
            "binaries": [
              {
                "guava": "33.7.2-160000.1.1",
                "guava-javadoc": "33.7.2-160000.1.1",
                "guava-testlib": "33.7.2-160000.1.1"
              }
            ]
          }
        }
      ],
      "modified": "2026-10-23T17:23:10.677463702Z",
      "provider": "osv",
      "upstream": [
        "CVE-2026-102554"
      ],
      "references": [
        "https://www.suse.com/support/update/announcement/2026/suse-su-202624263-1/",
        "https://bugzilla.suse.com/1284985",
        "https://www.suse.com/security/cve/CVE-2026-102554"
      ]
    },
    "related_cves": [
      {
        "value": "CVE-2026-102554",
        "evidence": "/upstream"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 415640,
  "published_at": "2026-10-20T13:36:37+00:00"
}