CVE-2018-10237

Severity: medium (CVSS 5.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-04-26 · updated 2026-06-17
Weakness: CWE-770

Description

Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.

Affected products

Google Guava: from 11.0 before 24.1.1 — fixed in 24.1.1
Oracle Corporation Banking Payments: from 14.1.0 through 14.4.0
Oracle Communications Ip Service Activator: 7.3.0, 7.4.0
Oracle Customer Management And Segmentation Foundation: 18.0
Oracle Database: 12.2.0.1, 18c, 19c
Oracle Corporation FLEXCUBE Investor Servicing: 12.1.0, 12.3.0, 12.4.0, 14.0.0, 14.1.0
Oracle Corporation FLEXCUBE Private Banking: 12.0.0, 12.1.0
Oracle Corporation Oracle Retail Integration Bus: 15.0, 16.0
Oracle Corporation Retail Xstore Point of Service: 7.1, 15.0, 16.0, 17.0
Oracle WebLogic Server: 12.2.1.3.0
Red Hat JBoss EAP: 6.0.0, 6.4.0, 7.1.0
Red Hat OpenShift Container Platform 4.18: 3.11, 4.1
OpenStack: 13
Red Hat Satellite 6: 6.4
RedHat Satellite Capsule: 6.4
RedHat Virtualization: 4.2, 4.0
RedHat Virtualization Host: 4.0

How to fix

Upgrade to a fixed version: Google Guava 24.1.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2018-10237 or the next vulnerability affects your stack