CoreCVE
Back

MEDIUM

guava: Unbounded memory allocation in AtomicDoubleArray and CompoundOrdering classes allow remote attackers to cause a denial of service

Published Apr 26, 2018

Description

Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.

Affected products

Remediation

Red Hat statement

Red Hat Openshift Application Runtimes: Eclipse Vert.x is not exploitable by this flaw, though the vulnerable code is a transient dependency to the product. This issue may be addressed in a future release.

Metrics

Weaknesses (3)

CWE-119

Buffer Overflow

CWE-502

Deserialization of Untrusted Data

CWE-770

Allocation of Resources Without Limits

References (93)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Apr 26, 2018
Updated Aug 5, 2024
Reserved Apr 20, 2018
Link CVE-2018-10237
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2018-10237
Red Hat
Severity Moderate
Public date Apr 25, 2018
Links CVE-2018-10237 - Bugzilla
GHSA-MVR2-9PJ6-7W5J