--===============5815963754603364901==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit

# Security update for guava

Announcement ID: SUSE-SU-2026:24263-1
Release Date: 2026-10-20T13:40:00Z
Rating: important
References:

* bsc#1284985

Cross-References:

* CVE-2026-102554

CVSS scores:

* CVE-2026-102554 ( SUSE ): 8.2

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2026-102554 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-102554 ( NVD ): 8.2

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected Products:

* SUSE Linux Enterprise Server 16.0
* SUSE Linux Enterprise Server for SAP applications 16.0

An update that solves one vulnerability can now be installed.

## Description:

This update for guava fixes the following issue:

* CVE-2026-102554: Allocation of resources without limits or throttling
(CWE-770) during Java object deserialization allows an attacker to cause a
Denial of Service via OutOfMemoryError (bsc#1284985).

Changes for guava:

* Adapt the generated OSGi data to reality
* Upgrade to guava 33.7.2
* Changes of 33.7.2
* collect: Changed MapMaker, CompactHashMap, and CompactHashSet
deserialization to avoid eagerly allocating as much memory as a
serialization payload requests (bsc#1284985, CVE-2026-102554)
* Changes of 33.7.1
* removes the Multi-Release line from our jar manifest, fixing an issue under
Java 9 and 10 that was introduced to guava-jre in version 33.7.0.
* Changes of 33.7.0
* Guava module-info.class is now present at the root of the jar instead of
under a multi-release root. This prevents the jar from containing a file at
META-INF/versions/9/OSGI-INF/ /MANIFEST.MF, which occasionally causes
trouble for some users
* collect: Changed some ImmutableMap implementations to create a new,
lightweight object on each call to view methods like keySet(), rather than
creating and storing that object during the first call for reuse later.
This
is likely to slightly improve performance for some users, but it could lead
to regressions in unusual cases, such as repeatedly calling
asMultimap().inverse() on the same ImmutableMap instance.
* net: Added HttpHeaders constant for on-prefetch-activation.
* net: Added MediaType constants for application/yaml and application/x-pem-
file.
* util.concurrent: Fixed ExecutionSequencer queue stall when delegate
executor
throws RejectedExecutionException.
* Changes of 33.6.0
* Migrated some classes from finalize() to PhantomReference in preparation
for
the removal of finalization.
* cache: Deprecated CacheBuilder APIs that use TimeUnit in favor of those
that
use Duration.
* collect: Added toImmutableSortedMap collectors that use the natural
comparator.
* collect: Changed ConcurrentHashMultiset, ImmutableMultimap, and
TreeMultiset
deserialization to avoid mutating final fields. In extremely unlikely
scenarios in which an instance of that type contains an object that refers
back to that instance, this could lead to a broken instance that throws
NullPointerException when used.
* graph: Removed @Beta from all APIs in the package.
* graph: Added support to Graphs.transitiveClosure() for different strategies
for adding self-loops.
* graph: Added an asNetwork() view to Graph and ValueGraph.
* hash: Added BloomFilter.serializedSize().
* net: Added HttpHeaders.CDN_CACHE_CONTROL.
* Changes of 33.5.0
* For users of guava-gwt: Google has moved off GWT internally. We plan to
continue to release guava-gwt for users of GWT and J2CL, but the artifact
is
no longer tested for GWT-specific issues, and we have limited resources to
fix any unexpected issues that might arise. While we do not anticipate any
specific problems, we can't guarantee how long support will continue.
* Listed the JSpecify annotations as an optional dependency in our OSGi
metadata.
* cache: Improved the handling of exceptions from compute functions in
Cache.asMap(). (We do still recommend using Caffeine rather than
com.google.common.cache.)
* collect: Improved Iterators.mergeSorted() to preserve stability for equal
elements.
* math: Added saturatedAbs methods to IntMath and LongMath.
* net: Added image/avif to MediaType.
* util.concurrent: Added Striped.custom.

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

* SUSE Linux Enterprise Server for SAP applications 16.0
zypper in -t patch SUSE-SLES-16.0-1947

* SUSE Linux Enterprise Server 16.0
zypper in -t patch SUSE-SLES-16.0-1947

## Package List:

* SUSE Linux Enterprise Server for SAP applications 16.0 (noarch)
* guava-javadoc-33.7.2-160000.1.1
* guava-33.7.2-160000.1.1
* guava-testlib-33.7.2-160000.1.1
* SUSE Linux Enterprise Server 16.0 (noarch)
* guava-javadoc-33.7.2-160000.1.1
* guava-33.7.2-160000.1.1
* guava-testlib-33.7.2-160000.1.1

## References:

* https://www.suse.com/security/cve/CVE-2026-102554.html
* https://bugzilla.suse.com/show_bug.cgi?id=1284985

--===============5815963754603364901==
Content-Type: text/html; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit

<div class="container">
<h1>Security update for guava</h1>

<table class="table table-striped table-bordered">
<tbody>
<tr>
<th>Announcement ID:</th>
<td>SUSE-SU-2026:24263-1</td>
</tr>
<tr>
<th>Release Date:</th>
<td>2026-10-20T13:40:00Z</td>
</tr>

<tr>
<th>Rating:</th>
<td>important</td>
</tr>
<tr>
<th>References:</th>
<td>
<ul>

<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1284985">bsc#1284985</a>
</li>

</ul>
</td>
</tr>

<tr>
<th>
Cross-References:
</th>
<td>
<ul>

<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-102554.html">CVE-2026-102554</a>
</li>

</ul>
</td>
</tr>
<tr>
<th>CVSS scores:</th>
<td>
<ul class="list-group">

<li class="list-group-item">
<span
class="cvss-reference">CVE-2026-102554</span>
<span class="cvss-source">
(

SUSE

):
</span>
<span
class="cvss-score">8.2</span>
<span
class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>

<li class="list-group-item">
<span
class="cvss-reference">CVE-2026-102554</span>
<span class="cvss-source">
(

SUSE

):
</span>
<span
class="cvss-score">7.5</span>
<span
class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>

<li class="list-group-item">
<span
class="cvss-reference">CVE-2026-102554</span>
<span class="cvss-source">
(

NVD

):
</span>
<span
class="cvss-score">8.2</span>
<span
class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>

</ul>
</td>
</tr>

<tr>
<th>Affected Products:</th>
<td>
<ul class="list-group">

<li class="list-group-item">SUSE Linux
Enterprise Server 16.0</li>

<li class="list-group-item">SUSE Linux
Enterprise Server for SAP applications 16.0</li>

</ul>
</td>
</tr>
</tbody>
</table>

<p>An update that solves one vulnerability can now be
installed.</p>

<h2>Description:</h2>

<p>This update for guava fixes the following issue:</p>
<ul>
<li>CVE-2026-102554: Allocation of resources without limits or throttling
(CWE-770) during Java object deserialization
allows an attacker to cause a Denial of Service via OutOfMemoryError
(bsc#1284985).</li>
</ul>
<p>Changes for guava:</p>
<ul>
<li>Adapt the generated OSGi data to reality</li>
<li>Upgrade to guava 33.7.2</li>
<li>Changes of 33.7.2</li>
<li>collect: Changed MapMaker, CompactHashMap, and CompactHashSet
deserialization to avoid eagerly allocating as much memory as
a serialization payload requests (bsc#1284985,
CVE-2026-102554)</li>
<li>Changes of 33.7.1</li>
<li>removes the Multi-Release line from our jar manifest, fixing
an issue under Java 9 and 10 that was introduced to guava-jre
in version 33.7.0.</li>
<li>Changes of 33.7.0</li>
<li>Guava module-info.class is now present at the root of the jar
instead of under a multi-release root. This prevents the jar
from containing a file at META-INF/versions/9/OSGI-INF/
/MANIFEST.MF, which occasionally causes trouble for some users</li>
<li>collect: Changed some ImmutableMap implementations to create a
new, lightweight object on each call to view methods like
keySet(), rather than creating and storing that object during
the first call for reuse later. This is likely to slightly
improve performance for some users, but it could lead to
regressions in unusual cases, such as repeatedly calling
asMultimap().inverse() on the same ImmutableMap instance.</li>
<li>net: Added HttpHeaders constant for
on-prefetch-activation.</li>
<li>net: Added MediaType constants for application/yaml and
application/x-pem-file.</li>
<li>util.concurrent: Fixed ExecutionSequencer queue stall when
delegate executor throws RejectedExecutionException.</li>
<li>Changes of 33.6.0</li>
<li>Migrated some classes from finalize() to PhantomReference in
preparation for the removal of finalization.</li>
<li>cache: Deprecated CacheBuilder APIs that use TimeUnit in favor
of those that use Duration.</li>
<li>collect: Added toImmutableSortedMap collectors that use the
natural comparator.</li>
<li>collect: Changed ConcurrentHashMultiset, ImmutableMultimap,
and TreeMultiset deserialization to avoid mutating final
fields. In extremely unlikely scenarios in which an instance
of that type contains an object that refers back to that
instance, this could lead to a broken instance that throws
NullPointerException when used.</li>
<li>graph: Removed @Beta from all APIs in the package.</li>
<li>graph: Added support to Graphs.transitiveClosure() for
different strategies for adding self-loops.</li>
<li>graph: Added an asNetwork() view to Graph and ValueGraph.</li>
<li>hash: Added BloomFilter.serializedSize().</li>
<li>net: Added HttpHeaders.CDN_CACHE_CONTROL.</li>
<li>Changes of 33.5.0</li>
<li>For users of guava-gwt: Google has moved off GWT internally.
We plan to continue to release guava-gwt for users of GWT and
J2CL, but the artifact is no longer tested for GWT-specific
issues, and we have limited resources to fix any unexpected
issues that might arise. While we do not anticipate any
specific problems, we can&#x27;t guarantee how long support will
continue.</li>
<li>Listed the JSpecify annotations as an optional dependency in
our OSGi metadata.</li>
<li>cache: Improved the handling of exceptions from compute
functions in Cache.asMap(). (We do still recommend using
Caffeine rather than com.google.common.cache.)</li>
<li>collect: Improved Iterators.mergeSorted() to preserve
stability for equal elements.</li>
<li>math: Added saturatedAbs methods to IntMath and LongMath.</li>
<li>net: Added image/avif to MediaType.</li>
<li>util.concurrent: Added Striped.custom.</li>
</ul>

<h2>Patch Instructions:</h2>
<p>
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper
patch".<br/>

Alternatively you can run the command listed for your product:
</p>
<ul class="list-group">

<li class="list-group-item">
SUSE Linux Enterprise Server for SAP applications 16.0

<br/>
<code>zypper in -t patch
SUSE-SLES-16.0-1947</code>

</li>

<li class="list-group-item">
SUSE Linux Enterprise Server 16.0

<br/>
<code>zypper in -t patch
SUSE-SLES-16.0-1947</code>

</li>

</ul>

<h2>Package List:</h2>
<ul>

<li>
SUSE Linux Enterprise Server for SAP applications 16.0
(noarch)
<ul>

<li>guava-javadoc-33.7.2-160000.1.1</li>

<li>guava-33.7.2-160000.1.1</li>

<li>guava-testlib-33.7.2-160000.1.1</li>

</ul>
</li>

<li>
SUSE Linux Enterprise Server 16.0 (noarch)
<ul>

<li>guava-javadoc-33.7.2-160000.1.1</li>

<li>guava-33.7.2-160000.1.1</li>

<li>guava-testlib-33.7.2-160000.1.1</li>

</ul>
</li>

</ul>

<h2>References:</h2>
<ul>

<li>
<a href="https://www.suse.com/security/cve/CVE-2026-102554.html">https://www.suse.com/security/cve/CVE-2026-102554.html</a>
</li>

<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1284985">https://bugzilla.suse.com/show_bug.cgi?id=1284985</a>
</li>

</ul>

</div>

--===============5815963754603364901==--