CVE catalog
CVE-2018-10237
guava-libraries: CVE-2018-10237
- Severity
- Medium · CVSS 5.9
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 5.09% · Oct 25, 2026
Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | guava-libraries | sid | 33.7.1-1 | fixed |
| Debian | guava-libraries | forky | 33.7.1-1 | fixed |
| Debian | guava-libraries | trixie | 32.0.1-1 | fixed |
| Debian | guava-libraries | bookworm | 31.1-1 | fixed |
| Ubuntu | guava-libraries | 14.04 | 14.0.1-1 | vulnerable |
| Ubuntu | guava-libraries | 14.04 | 15.0-2ubuntu1 | vulnerable |
| Ubuntu | guava-libraries | 16.04 | 18.0-4ubuntu1 | vulnerable |
| Ubuntu | guava-libraries | 16.04 | 19.0-1 | vulnerable |
| Ubuntu | guava-libraries | 18.04 | 19.0-1 | vulnerable |
| Ubuntu | guava-libraries | 20.04 | 19.0-1 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | guava-libraries | source | sid | 29.0-1 | not yet assigned | Not reported | Not reported |
| Debian | guava-libraries | source | forky | 29.0-1 | not yet assigned | Not reported | Not reported |
| Debian | guava-libraries | source | trixie | 29.0-1 | not yet assigned | Not reported | Not reported |
| Debian | guava-libraries | source | bookworm | 29.0-1 | not yet assigned | Not reported | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [libguava-java]Fixed
Source package: [guava-libraries]
Details (2)
31.1-1· all · bookwormFixed · Fixed:
29.0-1dsa · guava-libraries · debian · bookworm; dsa · guava-libraries · debian · 12
31.1-1· all · bookwormFixed · Fixed:
29.0-1dsa · guava-libraries · debian · bookworm; dsa · guava-libraries · debian · 12
- [libguava-testlib-java]Fixed
Source package: [guava-libraries]
Details (2)
31.1-1· all · bookwormFixed · Fixed:
29.0-1dsa · guava-libraries · debian · bookworm; dsa · guava-libraries · debian · 12
31.1-1· all · bookwormFixed · Fixed:
29.0-1dsa · guava-libraries · debian · bookworm; dsa · guava-libraries · debian · 12
[Debian 13 (Trixie)]
- [libguava-java]Fixed
Source package: [guava-libraries]
Details (2)
32.0.1-1· all · trixieFixed · Fixed:
29.0-1dsa · guava-libraries · debian · 13
32.0.1-1· all · trixieFixed · Fixed:
29.0-1dsa · guava-libraries · debian · 13
- [libguava-testlib-java]Fixed
Source package: [guava-libraries]
Details (2)
32.0.1-1· all · trixieFixed · Fixed:
29.0-1dsa · guava-libraries · debian · 13
32.0.1-1· all · trixieFixed · Fixed:
29.0-1dsa · guava-libraries · debian · 13
Observed:
References
- [https://osv.dev/vulnerability/DEBIAN-CVE-2018-10237]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2018-10237]
- [https://security-tracker.debian.org/tracker/CVE-2018-10237]
- [https://security.access.redhat.com/data/csaf/v2/vex/2018/cve-2018-10237.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-1594.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]