A crafted serialization stream can cause Guava’s CompactHashMap, CompactHashSet, or MapMakerInternalMap to eagerly allocate an array sized from the input without any limits or throttling. The resulting allocation can exhaust heap memory, raise an OutOfMemoryError, and bring the application or process down. This flaw is a deserialization weakness (CWE‑502) coupled with uncontrolled resource consumption (CWE‑770), and its primary impact is denial of service.

Google Guava Java library, versions 4.0 through 33.7.1. Any Java application that deserializes CompactHashMap, CompactHashSet, or MapMakerInternalMap objects from untrusted data is vulnerable.

The CVSS score of 8.2 reflects high severity, and although the EPSS score is not available, the lack of input size limits makes exploitation straightforward. The vulnerability is not listed in CISA KEV, meaning no publicly known exploits exist yet, but attackers can target applications that perform deserialization of Guava objects. No special privileges are needed beyond delivering a malicious serialized payload.