Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks…

Description

Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.

Scores

EPSS (exploitation in 30 days)

8.4% · top 5.0% of all CVEs (4 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.9.

Weakness

• n/a
• CWE-770 (opens in a new tab)All about CWE-770 and its CVEs

Affected products

• n/a

  • affected n/a

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• Mavencom.google.guava:guavaGHSA-mvr2-9pj6-7w5j (opens in a new tab)
• Mavencom.google.guava:guava-jdk5GHSA-mvr2-9pj6-7w5j (opens in a new tab)
• Mavencom.googlecode.guava-osgi:guava-osgiGHSA-mvr2-9pj6-7w5j (opens in a new tab)
• Mavende.mhus.ports:vaadin-shared-depsGHSA-mvr2-9pj6-7w5j (opens in a new tab)
• Mavenorg.hudsonci.lib.guava:guavaGHSA-mvr2-9pj6-7w5j (opens in a new tab)
• Mavenorg.sonatype.sisu:sisu-guavaGHSA-mvr2-9pj6-7w5j (opens in a new tab)

References (53)

• RHSA-2018:2428 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2018:2740 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2018:2741 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2018:2742 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2018:2598 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2018:2643 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2018:2424 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2018:2423 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2018:2425 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2018:2927 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• 1041707 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• RHSA-2018:2743 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• [hadoop-hdfs-dev] 20190401 Update guava to 27.0-jre in hadoop-project (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [hadoop-common-dev] 20190401 Update guava to 27.0-jre in hadoop-project (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [pulsar-commits] 20190416 [GitHub] [pulsar] one70six opened a new issue #4057: Security Vulnerabilities - Black Duck Scan - Pulsar v.2.3.1 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [activemq-issues] 20190516 [jira] [Created] (AMQ-7208) Security Issue related to Guava 18.0 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [activemq-gitbox] 20190530 [GitHub] [activemq-artemis] brusdev opened a new pull request #2687: ARTEMIS-2359 Upgrade to Guava 24.1 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [cassandra-commits] 20190612 [jira] [Assigned] (CASSANDRA-14760) CVE-2018-10237 Security vulnerability in 3.11.3 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [activemq-issues] 20190820 [jira] [Created] (AMQ-7279) Security Vulnerabilities in Libraries - jackson-databind-2.9.8.jar, tomcat-servlet-api-8.0.53.jar, tomcat-websocket-api-8.0.53.jar, zookeeper-3.4.6.jar, guava-18.0.jar, jetty-all-9.2.26.v20180806.jar, scala-library-2.11.0.jar (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• RHSA-2019:2858 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• RHSA-2019:3149 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [cxf-dev] 20200206 [GitHub] [cxf] davidkarlsen opened a new pull request #638: upgrade guava, CVE-2018-10237 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [cxf-dev] 20200206 [GitHub] [cxf] reta commented on a change in pull request #638: upgrade guava, CVE-2018-10237 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [cxf-dev] 20200211 [GitHub] [cxf] coheigea commented on a change in pull request #638: upgrade guava, CVE-2018-10237 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [kafka-users] 20200413 CVEs for the dependency software guava and rocksdbjni of Kafka (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [cxf-dev] 20200420 [GitHub] [cxf] coheigea commented on a change in pull request #638: upgrade guava, CVE-2018-10237 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [cxf-dev] 20200420 [GitHub] [cxf] reta commented on a change in pull request #638: upgrade guava, CVE-2018-10237 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [cxf-dev] 20200420 [GitHub] [cxf] andrei-ivanov commented on a change in pull request #638: upgrade guava, CVE-2018-10237 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [syncope-dev] 20200423 Re: Time to cut 2.1.6 / 2.0.15? (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• https://www.oracle.com/security-alerts/cpuapr2020.html (opens in a new tab)x_refsource_MISCx_transferred
• [hadoop-common-dev] 20200623 Update guava to 27.0-jre in hadoop branch-2.10 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• https://www.oracle.com/security-alerts/cpujul2020.html (opens in a new tab)x_refsource_MISCx_transferred
• https://groups.google.com/d/topic/guava-announce/xqWALw4W1vs/discussion (opens in a new tab)x_refsource_CONFIRMx_transferred
• [flink-dev] 20200806 Dependency vulnerabilities with Apache Flink 1.10.1 version (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [flink-user] 20200806 Dependency vulnerabilities with Apache Flink 1.10.1 version (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [flink-dev] 20200806 [jira] [Created] (FLINK-18841) CVE-2018-10237 and CWE-400 occurred in flink dependency (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [flink-issues] 20200806 [jira] [Created] (FLINK-18841) CVE-2018-10237 and CWE-400 occurred in flink dependency (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [flink-issues] 20200814 [jira] [Commented] (FLINK-18841) CVE-2018-10237 and CWE-400 occurred in flink dependency (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [lucene-issues] 20201022 [jira] [Created] (SOLR-14960) Solr-clustering is bringing in CVE-2018-10237 vulnerable guava (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [lucene-issues] 20201022 [jira] [Updated] (SOLR-14960) Solr-clustering is bringing in CVE-2018-10237 vulnerable guava (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [lucene-issues] 20201022 [jira] [Resolved] (SOLR-14960) Solr-clustering is bringing in CVE-2018-10237 vulnerable guava (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• https://www.oracle.com/security-alerts/cpujan2021.html (opens in a new tab)x_refsource_MISCx_transferred
• [maven-issues] 20210122 [GitHub] [maven-indexer] akurtakov opened a new pull request #75: Remove guava dependency from indexer-core (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [flink-issues] 20210212 [jira] [Closed] (FLINK-18841) CVE-2018-10237 and CWE-400 occurred in flink dependency (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [samza-commits] 20210310 [GitHub] [samza] Telesia opened a new pull request #1471: SAMZA-2630: Upgrade dependencies for security fixes (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [storm-issues] 20210315 [jira] [Created] (STORM-3754) Upgrade Guava version because of security vulnerability (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [pulsar-commits] 20210406 [GitHub] [pulsar] lhotari opened a new pull request #10149: Upgrade jclouds to 2.3.0 to fix security vulnerabilities (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [arrow-github] 20210610 [GitHub] [arrow] projjal opened a new pull request #10501: ARROW-13032: Update guava version (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• https://www.oracle.com/security-alerts/cpuoct2021.html (opens in a new tab)x_refsource_MISCx_transferred
• https://security.netapp.com/advisory/ntap-20220629-0008/ (opens in a new tab)x_refsource_CONFIRMx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-mvr2-9pj6-7w5j (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2018-10237](https://trackcve.app/badge/CVE-2018-10237.svg)](https://trackcve.app/cve/CVE-2018-10237)

Record last updated 5 Aug 2024, 07:32 UTC.