Repository navigation
Guava CVE-2026-102554 #4496
Description
graphql-java currently includes guava 32.1.2-jre from 2023-07-31. Just today, Guava has a newly disclosed HIGH severity security vulnerability:
https://osv.dev/vulnerability/CVE-2026-102554
https://www.cve.org/CVERecord?id=CVE-2026-102554
This CVE affects Guava versions through 33.7.1. The current version is 33.7.2-jre which was released two weeks ago to specifically address this vulnerability:
https://github.com/google/guava/releases/tag/v33.7.2
Various security scanner tools identify the version of Guava that is included inside of the graphql-java jar file and report this associated CVE, raising alarms for users who use and deploy applications having the graphql-java jar.
Activity
[-]GraphQL CVE-2026-102554[/-][+]Guava CVE-2026-102554[/+]VelpulaGangavardhan commentedon Oct 15, 2026
Hi, I'd like to contribute to this issue. I'll inspect how Guava is packaged in graphql-java, verify compatibility with the project's supported Java version, and investigate updating it to the patched
33.7.2-jreversion. I'll run the relevant dependency checks and tests before submitting a PR.Please let me know if a maintainer is already preparing this update or if there are any compatibility constraints I should consider.
benken-parasoft commentedon Oct 15, 2026
Sounds good! Here are my quick observations:
Guava still requires a minimum of Java 8. This is stated in their README but is also plainly visible in the their pom.xml. The MANIFEST.MF of the actual jar has an OSGi Require-Capability header expressing the minimum requirement on Java 8.
graphql-java targets Java 11 as stated in their docs but is also plainly visible in their build.gradle.
I suspect there being no particular reason for the version of Guava not being updated in years but this is only my speculation.
VelpulaGangavardhan commentedon Oct 16, 2026
Thanks for confirming the Java compatibility details! I'll proceed with updating Guava to
33.7.2-jre, verify the shaded JAR, and run the relevant tests and build checks. I'll open a PR once the changes are verified.