Guava vulnerabilities

2 known vulnerabilities in Guava from Google. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.2 High severity

  Guava: Deserialization of Untrusted Data

  CVE-2026-102554Oct 9, 2026Google

  Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSe

• 7.1 High severity

  Guava: Files or Directories Accessible to External Parties

  CVE-2023-2976Jun 14, 2023Google

  Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary dir