Register | Log in

guava-libraries

Choose email to subscribe with

general

source: guava-libraries (main)
version: 33.7.1-1
maintainer: Debian Java Maintainers (archive) (DMD)
uploaders: James Page [DMD] – Emmanuel Bourg [DMD]
arch: all
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 29.0-6
oldstable: 31.1-1
stable: 32.0.1-1
testing: 33.7.1-1
unstable: 33.7.1-1

versioned links

29.0-6: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
31.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
32.0.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
33.7.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libguava-java
libguava-testlib-java

action needed

A new upstream version is available: 33.7.2 high

A new upstream version 33.7.2 is available, you should consider packaging it.

Created: 2026-09-29 Last update: 2026-10-14 09:30

1 security issue in trixie high

There is 1 open security issue in trixie.

1 important issue:

CVE-2026-102554: Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams.

Created: 2026-10-10 Last update: 2026-10-10 11:00

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2026-102554: Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams.

Created: 2026-10-10 Last update: 2026-10-10 11:00

1 security issue in forky high

There is 1 open security issue in forky.

1 important issue:

CVE-2026-102554: Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams.

Created: 2026-10-10 Last update: 2026-10-10 11:00

3 security issues in bookworm high

There are 3 open security issues in bookworm.

1 important issue:

CVE-2026-102554: Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams.

2 ignored issues:

CVE-2020-8908: A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.
CVE-2023-2976: Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class. Even though the security vulnerability is fixed in version 32.0.0, we recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.

Created: 2026-10-10 Last update: 2026-10-10 11:00

1 open merge request in Salsa normal

There is 1 open merge request for this package on Salsa. You should consider reviewing and/or merging these merge requests.

Created: 2026-09-29 Last update: 2026-09-29 15:30

debian/patches: 1 patch to forward upstream low

Among the 16 debian patches available in version 33.7.1-1 of the package, we noticed the following issues:

1 patch where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2026-09-29 19:02

news

[2026-10-07] guava-libraries 33.7.1-1 MIGRATED to testing (Debian testing watch)
[2026-09-29] Accepted guava-libraries 33.7.1-1 (source) into unstable (Emmanuel Bourg)
[2023-06-30] guava-libraries 32.0.1-1 MIGRATED to testing (Debian testing watch)
[2023-06-24] Accepted guava-libraries 32.0.1-1 (source) into unstable (tony mancill)
[2022-12-20] guava-libraries 31.1-1 MIGRATED to testing (Debian testing watch)
[2022-12-12] Accepted guava-libraries 31.1-1 (source) into unstable (Emmanuel Bourg)
[2021-02-22] Accepted guava-libraries 29.0-6~bpo10+1 (source all) into buster-backports, buster-backports (Debian FTP Masters) (signed by: Sudip Mukherjee)
[2020-10-03] guava-libraries 29.0-6 MIGRATED to testing (Debian testing watch)
[2020-09-27] Accepted guava-libraries 29.0-6 (source) into unstable (Sudip Mukherjee)
[2020-06-12] guava-libraries 29.0-5 MIGRATED to testing (Debian testing watch)
[2020-06-06] Accepted guava-libraries 29.0-5 (source) into unstable (Emmanuel Bourg)
[2020-05-28] guava-libraries 29.0-4 MIGRATED to testing (Debian testing watch)
[2020-05-20] Accepted guava-libraries 29.0-4 (source) into unstable (Emmanuel Bourg)
[2020-05-19] Accepted guava-libraries 29.0-3 (source) into unstable (Emmanuel Bourg)
[2020-05-11] Accepted guava-libraries 29.0-2 (source all) into unstable, unstable (Debian FTP Masters) (signed by: Emmanuel Bourg)
[2020-05-10] Accepted guava-libraries 29.0-1 (source) into unstable (Emmanuel Bourg)
[2020-05-06] Accepted guava-libraries 29.0-1~exp1 (source) into experimental (Emmanuel Bourg)
[2020-05-02] Accepted guava-libraries 23.6.1-1~exp1 (source) into experimental (Emmanuel Bourg)
[2016-10-12] Accepted guava-libraries 19.0-1~bpo8+1 (source all) into jessie-backports (Emmanuel Bourg)
[2015-12-23] guava-libraries 19.0-1 MIGRATED to testing (Debian testing watch)
[2015-12-18] Accepted guava-libraries 19.0-1 (source all) into unstable (Emmanuel Bourg)
[2015-07-30] guava-libraries 18.0-4 MIGRATED to testing (Britney)
[2015-07-24] Accepted guava-libraries 18.0-4 (source all) into unstable (Emmanuel Bourg)
[2015-07-09] guava-libraries 18.0-3 MIGRATED to testing (Britney)
[2015-07-03] Accepted guava-libraries 18.0-3 (source all) into unstable (Emmanuel Bourg)
[2015-06-10] guava-libraries 18.0-2 MIGRATED to testing (Britney)
[2015-05-28] guava-libraries 18.0-1 MIGRATED to testing (Britney)
[2015-05-22] Accepted guava-libraries 18.0-1 (source all) into unstable (Emmanuel Bourg)
[2014-07-08] guava-libraries 17.0-1 MIGRATED to testing (Britney)
[2014-07-02] Accepted guava-libraries 17.0-1 (source all) (Emmanuel Bourg)

1
2

bugs [bug history graph]

all: 1
RC: 0
I&N: 1
M&W: 0
F&P: 0
patch: 0

links

homepage
lintian
buildd: logs, reproducibility
popcon
browse source code
other distros
security tracker
debian patches

ubuntu

[Information about Ubuntu for Debian Developers]

version: 32.0.1-1build1

Debian Package Tracker — Copyright 2013-2025 The Distro Tracker Developers

Report problems to the tracker.debian.org pseudo-package in the Debian BTS.

Documentation — Bugs — Git Repository — Contributing