The Double.parseDouble method in Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0…

Description

The Double.parseDouble method in Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 and earlier, as used in OpenJDK, Apache, JBossweb, and other products, allows remote attackers to cause a denial of service via a crafted string that triggers an infinite loop of estimations during conversion to a double-precision binary floating-point number, as demonstrated using 2.2250738585072012e-308.

Scores

EPSS (exploitation in 30 days)

23.5% · top 2.2% of all CVEs (4 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.0.

Weakness

• n/a

Affected products

• n/a

  • affected n/a

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• Mavenorg.apache.tomcat:tomcatGHSA-gvgc-rxmh-5hvw (opens in a new tab)

References (68)

• 43295 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 1025062 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS11-003/index.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• 43280 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• RHSA-2011:0210 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• GLSA-201406-32 (opens in a new tab)vendor-advisoryx_refsource_GENTOOx_transferred
• oval:org.mitre.oval:def:14328 (opens in a new tab)vdb-entrysignaturex_refsource_OVALx_transferred
• HPSBMU02799 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• FEDORA-2011-1231 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• FEDORA-2011-1263 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• SUSE-SU-2011:0823 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
• HPSBNS02633 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• SSRT100387 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• HPSBUX02860 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• RHSA-2011:0214 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• PM31983 (opens in a new tab)vendor-advisoryx_refsource_AIXAPARx_transferred
• 45555 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• IZ94423 (opens in a new tab)vendor-advisoryx_refsource_AIXAPARx_transferred
• 43400 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• SSRT100412 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• HPSBMA02642 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• 43378 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 45022 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• RHSA-2011:0333 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• ADV-2011-0422 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• oval:org.mitre.oval:def:12662 (opens in a new tab)vdb-entrysignaturex_refsource_OVALx_transferred
• http://www.oracle.com/technetwork/topics/security/javacpufeb2011-304611.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• HPSBMU02690 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• ADV-2011-0434 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• HPSBOV02762 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• oval:org.mitre.oval:def:14589 (opens in a new tab)vdb-entrysignaturex_refsource_OVALx_transferred
• RHSA-2011:0213 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• SSRT100627 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• http://www.exploringbinary.com/java-hangs-when-converting-2-2250738585072012e-308/ (opens in a new tab)x_refsource_MISCx_transferred
• ADV-2011-0377 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• 44954 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• HPSBOV02634 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• ADV-2011-0365 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• http://blogs.oracle.com/security/2011/02/security_alert_for_cve-2010-44.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• RHSA-2011:0880 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• oval:org.mitre.oval:def:12745 (opens in a new tab)vdb-entrysignaturex_refsource_OVALx_transferred
• RHSA-2011:0334 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2011:0282 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• http://www-01.ibm.com/support/docview.wss?uid=swg21468358 (opens in a new tab)x_refsource_CONFIRMx_transferred
• 43048 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• DSA-2161 (opens in a new tab)vendor-advisoryx_refsource_DEBIANx_transferred
• ADV-2011-0379 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• 43304 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• RHSA-2011:0211 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• SSRT100867 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• 49198 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 43659 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• http://www.oracle.com/technetwork/topics/security/alert-cve-2010-4476-305811.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://www.ibm.com/support/docview.wss?uid=swg24029498 (opens in a new tab)x_refsource_CONFIRMx_transferred
• SUSE-SA:2011:024 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
• HPSBUX02777 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• oval:org.mitre.oval:def:19493 (opens in a new tab)vdb-entrysignaturex_refsource_OVALx_transferred
• 43333 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• HPSBUX02645 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• RHSA-2011:0212 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• HPSBUX02642 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5098550.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• ADV-2011-0605 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• http://blog.fortify.com/blog/2011/02/08/Double-Trouble (opens in a new tab)x_refsource_MISCx_transferred
• HPSBTU02684 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• http://www.ibm.com/support/docview.wss?uid=swg24029497 (opens in a new tab)x_refsource_CONFIRMx_transferred
• MDVSA-2011:054 (opens in a new tab)vendor-advisoryx_refsource_MANDRIVAx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-gvgc-rxmh-5hvw (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2010-4476](https://trackcve.app/badge/CVE-2010-4476.svg)](https://trackcve.app/cve/CVE-2010-4476)

Record last updated 7 Aug 2024, 03:43 UTC.