CVE-2026-102554
Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.
CVSS
—
No CVSS
EPSS
0.4%
p27
KEV
—
Exploit Today
8
0-100
Published: Oct 9, 2026 · Last modified: Oct 9, 2026 · CWE-502 · CWE-770
0.4%EPSS · 30 days0.4%
2026-10-102026-10-12
Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams.
- github.comhttps://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe
- github.comhttps://github.com/google/guava/releases/tag/v33.7.2
- github.comhttps://github.com/google/guava/security/advisories/GHSA-xxph-c9ww-hj94
- github.comhttps://github.com/google/guava/security/advisories/GHSA-xxph-c9ww-hj94
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-529038.8 HIG—
——0A deserialization of untrusted data vulnerability was found in ManageIQ. The YamlLoadAliases module overrides YAML.safe_load to silently fall back to YAML.unsafe_load in production when a Psych::DisallowedClass error occurs. An authenticated attacker with dialog import access can exploit this to achieve remote code execution by uploading a crafted YAML payload that triggers the fallback and deserializes arbitrary Ruby objects.
Red Hat CloudForms, which was based on ManageIQ, has reached End of Life and is no longer supported. No errata or patches will be issued. This CVE is being assigned for the benefit of the ManageIQ community and downstream consumers.1dCVE-2026-1087684.3 MED37.3%
——11A vulnerability was identified in zhayujie CowAgent up to 2.2.0. Affected by this issue is the function json.loads of the component Streaming Tool-Call Argument Handler. The manipulation leads to allocation of resources. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.2dCVE-2026-1088597.5 HIG44.1%
——13mcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTTPServer.ServeHTTP that allows remote unauthenticated attackers to exhaust memory by sending oversized POST bodies. Attackers can send arbitrarily large or many concurrent POST requests, read fully via io.ReadAll before validation, to degrade or OOM-kill the server process.2dCVE-2026-1087555.3 MED22.5%
——7Hatchet through 0.110.5 contains an allocation of resources without limits vulnerability that allows unauthenticated attackers to exhaust memory via the SNS ingestion endpoint. Attackers can send arbitrarily large or concurrent request bodies to POST /api/v1/sns/{tenant}/{event} with any UUID, which the SnsUpdate handler buffers before signature verification, degrading availability.2dCVE-2026-1087147.5 HIG27.6%
——8MCP Kotlin SDK through 0.15.0 contains an uncontrolled memory allocation vulnerability that allows remote clients to exhaust server memory because Application.mcpWebSocket installs Ktor WebSockets without a maxFrameSize limit. Attackers can send small frame headers declaring payloads near 2 GiB over one or a few connections, forcing huge heap allocations and causing denial of service.2dCVE-2026-817979.8 CRI23.1%
——7Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions.2d