venkatasaiachi commented on PR #18761: URL: https://github.com/apache/iceberg/pull/18761#issuecomment-6595500790
The `1.10.x` branch currently uses Guava `33.4.8-jre`, which is within the affected version range for CVE-2026-102554 (versions earlier than `33.7.2`). This vulnerability affects Java deserialization of certain Guava collection implementations, potentially leading to excessive memory allocation and denial of service. Since Iceberg bundles and relocates Guava, users consuming the `1.10.x` release line would continue to receive the affected Guava version unless we upgrade it. The purpose of this PR is to backport the Guava security fix to the `1.10.x` maintenance branch, allowing users to receive the updated dependency without having to move to a newer Iceberg minor version. Additionally, this change replaces the affected Guava `Queues` usages with equivalent JDK collection implementations to ensure compatibility with Shadow JAR minimization. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
