Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote…
Priority LOW 38CWE-770Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Denial of service, Code execution
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 16 fixed, 18 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770 and CWE-502.
Summary
Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.
Why it matters now
EPSS 0.08449 95th percentileScored 2026-11-07
Fix Partial com.google.guava:guava (Maven): 24.1.1-androidRed Hat: 14 advisoriesRed Hat: 16 fixed, 18 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | com.google.guava:guava (Maven) | 11.0 to before 24.1.1-android | 24.1.1-android | Patch available | GHSA-mvr2-9pj6-7w5j |
| — | com.google.guava:guava-jdk5 (Maven) | up to 17.0 | — | No fix listed | GHSA-mvr2-9pj6-7w5j |
| — | com.googlecode.guava-osgi:guava-osgi (Maven) | up to 11.0.1 | — | No fix listed | GHSA-mvr2-9pj6-7w5j |
| — | de.mhus.ports:vaadin-shared-deps (Maven) | up to 7.4.0 | — | No fix listed | GHSA-mvr2-9pj6-7w5j |
| — | org.hudsonci.lib.guava:guava (Maven) | up to 14.0.1-h-3 | — | No fix listed | GHSA-mvr2-9pj6-7w5j |
| — | org.sonatype.sisu:sisu-guava (Maven) | — | — | No fix listed | GHSA-mvr2-9pj6-7w5j |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- com.google.guava:guava (Maven) Vendor— Affected 11.0 to before 24.1.1-android Fixed in 24.1.1-android Patch available GHSA-mvr2-9pj6-7w5j
- com.google.guava:guava-jdk5 (Maven) Vendor— Affected up to 17.0 Fixed in — No fix listed GHSA-mvr2-9pj6-7w5j
- com.googlecode.guava-osgi:guava-osgi (Maven) Vendor— Affected up to 11.0.1 Fixed in — No fix listed GHSA-mvr2-9pj6-7w5j
- de.mhus.ports:vaadin-shared-deps (Maven) Vendor— Affected up to 7.4.0 Fixed in — No fix listed GHSA-mvr2-9pj6-7w5j
- org.hudsonci.lib.guava:guava (Maven) Vendor— Affected up to 14.0.1-h-3 Fixed in — No fix listed GHSA-mvr2-9pj6-7w5j
- org.sonatype.sisu:sisu-guava (Maven) Vendor— Affected — Fixed in — No fix listed GHSA-mvr2-9pj6-7w5j
CPE configurations NVD · 36
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:google:guava:*:*:*:*:*:*:*:* | 11.0 to before 24.1.1 | Vulnerable | |
| cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:* | 3.11 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:* | 13 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:satellite:6.4:*:*:*:*:*:*:* | 6.4 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:satellite_capsule:6.4:*:*:*:*:*:*:* | 6.4 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:virtualization:4.2:*:*:*:*:*:*:* | 4.2 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:* | 4.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:* | 6.0.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4.0:*:*:*:*:*:*:* | 6.4.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1.0:*:*:*:*:*:*:* | 7.1.0 | Vulnerable | Red Hat |
- cpe:2.3:a:google:guava:*:*:*:*:*:*:*:* Versions 11.0 to before 24.1.1 Vulnerable ·Google
- cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:* Versions 3.11 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:* Versions 13 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:satellite:6.4:*:*:*:*:*:*:* Versions 6.4 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:satellite_capsule:6.4:*:*:*:*:*:*:* Versions 6.4 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:virtualization:4.2:*:*:*:*:*:*:* Versions 4.2 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4.0:*:*:*:*:*:*:* Versions 6.4.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1.0:*:*:*:*:*:*:* Versions 7.1.0 Vulnerable ·Red Hat
Show 26 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:redhat:openshift_container_platform:4.1:*:*:*:*:*:*:* | 4.1 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:* | 4.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* | 7.0 | Running on | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:* | 5.0 | Running on | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* | 6.0 | Running on | Red Hat |
| cpe:2.3:a:oracle:banking_payments:*:*:*:*:*:*:*:* | 14.1.0 – 14.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_ip_service_activator:7.3.0:*:*:*:*:*:*:* | 7.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_ip_service_activator:7.4.0:*:*:*:*:*:*:* | 7.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:customer_management_and_segmentation_foundation:18.0:*:*:*:*:*:*:* | 18.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:database_server:12.2.0.1:*:*:*:*:*:*:* | 12.2.0.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:database_server:18c:*:*:*:*:*:*:* | 18c | Vulnerable | Oracle |
| cpe:2.3:a:oracle:database_server:19c:*:*:*:*:*:*:* | 19c | Vulnerable | Oracle |
| cpe:2.3:a:oracle:flexcube_investor_servicing:12.1.0:*:*:*:*:*:*:* | 12.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:flexcube_investor_servicing:12.3.0:*:*:*:*:*:*:* | 12.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:flexcube_investor_servicing:12.4.0:*:*:*:*:*:*:* | 12.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:flexcube_investor_servicing:14.0.0:*:*:*:*:*:*:* | 14.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:flexcube_investor_servicing:14.1.0:*:*:*:*:*:*:* | 14.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:* | 12.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:* | 12.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_integration_bus:15.0:*:*:*:*:*:*:* | 15.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_integration_bus:16.0:*:*:*:*:*:*:* | 16.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:* | 7.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0:*:*:*:*:*:*:* | 15.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0:*:*:*:*:*:*:* | 16.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:*:*:*:*:*:*:* | 17.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:* | 12.2.1.3.0 | Vulnerable | Oracle |
- cpe:2.3:a:redhat:openshift_container_platform:4.1:*:*:*:*:*:*:* Versions 4.1 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:* Versions 5.0 Running on ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Running on ·Red Hat
- cpe:2.3:a:oracle:banking_payments:*:*:*:*:*:*:*:* Versions 14.1.0 – 14.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_ip_service_activator:7.3.0:*:*:*:*:*:*:* Versions 7.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_ip_service_activator:7.4.0:*:*:*:*:*:*:* Versions 7.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:customer_management_and_segmentation_foundation:18.0:*:*:*:*:*:*:* Versions 18.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:database_server:12.2.0.1:*:*:*:*:*:*:* Versions 12.2.0.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:database_server:18c:*:*:*:*:*:*:* Versions 18c Vulnerable ·Oracle
- cpe:2.3:a:oracle:database_server:19c:*:*:*:*:*:*:* Versions 19c Vulnerable ·Oracle
- cpe:2.3:a:oracle:flexcube_investor_servicing:12.1.0:*:*:*:*:*:*:* Versions 12.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:flexcube_investor_servicing:12.3.0:*:*:*:*:*:*:* Versions 12.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:flexcube_investor_servicing:12.4.0:*:*:*:*:*:*:* Versions 12.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:flexcube_investor_servicing:14.0.0:*:*:*:*:*:*:* Versions 14.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:flexcube_investor_servicing:14.1.0:*:*:*:*:*:*:* Versions 14.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:* Versions 12.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:* Versions 12.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_integration_bus:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_integration_bus:16.0:*:*:*:*:*:*:* Versions 16.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:* Versions 7.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0:*:*:*:*:*:*:* Versions 16.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:*:*:*:*:*:*:* Versions 17.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
Remediation
- Fix · GHSA-mvr2-9pj6-7w5j com.google.guava:guava (Maven) Fixed in 24.1.1-android Advisory →
Red Hat 14 advisories
- RHSA-2020:2562 Released 2020-06-15 · Red Hat rating ImportantEAP Continuous Delivery Technical Preview Release 13 security update
- Red Hat JBoss Enterprise Application Platform Continuous Delivery
- RHSA-2019:3149 Released 2019-10-18 · Red Hat rating ImportantOpenShift Container Platform logging-elasticsearch5-container security update
- Red Hat OpenShift Container Platform 3.11 openshift3/ose-logging-elasticsearch5
- RHSA-2019:2858 Released 2019-09-27 · Red Hat rating ImportantOpenShift Container Platform 4.1.18 logging-elasticsearch5 security update
- Red Hat OpenShift Container Platform 4.1 openshift4/ose-logging-elasticsearch5
Show 11 more Red Hat advisories
- RHSA-2018:2927 Released 2018-10-16 · Red Hat rating ImportantSatellite 6.4 security, bug fix, and enhancement update
- Red Hat Satellite 6.4 SOAPpy-0.11.6-17.el7, ansiblerole-insights-client-1.5-1.el7sat, candlepin-2.4.8-1.el7 +47
- Red Hat Satellite Capsule 6.4 SOAPpy-0.11.6-17.el7, ansiblerole-insights-client-1.5-1.el7sat, createrepo_c-0.7.4-1.el7sat +47
- RHSA-2018:2743 Released 2018-09-24 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 6.4.21 security update
- Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server codehaus-jackson-1.9.9-14.redhat_7.1.ep6.el6, codehaus-jackson-core-asl-1.9.9-14.redhat_7.1.ep6.el6, codehaus-jackson-jaxrs-1.9.9-14.redhat_7.1.ep6.el6 +47
- RHSA-2018:2742 Released 2018-09-24 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 6.4.21 security update
- Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 Server codehaus-jackson-1.9.9-14.redhat_7.1.ep6.el5, codehaus-jackson-core-asl-1.9.9-14.redhat_7.1.ep6.el5, codehaus-jackson-jaxrs-1.9.9-14.redhat_7.1.ep6.el5 +47
- RHSA-2018:2741 Released 2018-09-24 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 6.4.21 security update
- Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server codehaus-jackson-1.9.9-14.redhat_7.1.ep6.el7, codehaus-jackson-core-asl-1.9.9-14.redhat_7.1.ep6.el7, codehaus-jackson-jaxrs-1.9.9-14.redhat_7.1.ep6.el7 +47
- RHSA-2018:2740 Released 2018-09-24 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 6.4.21 security update
- Red Hat JBoss Enterprise Application Platform 6.4
- RHSA-2018:2643 Released 2018-09-04 · Red Hat rating Importantrhvm-appliance security update
- Red Hat Virtualization 4 Hypervisor for RHEL 7 rhvm-appliance-2:4.2-20180828.0.el7
- Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts rhvm-appliance-2:4.2-20180828.0.el7
- RHSA-2018:2598 Released 2018-08-29 · Red Hat rating Moderateopendaylight security and bug fix update
- Red Hat OpenStack Platform 13.0 opendaylight-8.3.0-3.el7ost
- RHSA-2018:2424 Released 2018-08-15 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.1.4 on RHEL7 security update
- Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server eap7-activemq-artemis-1.5.5.013-1.redhat_1.1.ep7.el7, eap7-activemq-artemis-cli-1.5.5.013-1.redhat_1.1.ep7.el7, eap7-activemq-artemis-commons-1.5.5.013-1.redhat_1.1.ep7.el7 +47
- RHSA-2018:2423 Released 2018-08-15 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.1.4 on RHEL 6 security update
- Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server eap7-activemq-artemis-1.5.5.013-1.redhat_1.1.ep7.el6, eap7-activemq-artemis-cli-1.5.5.013-1.redhat_1.1.ep7.el6, eap7-activemq-artemis-commons-1.5.5.013-1.redhat_1.1.ep7.el6 +47
- RHSA-2018:2428 Released 2018-08-15 · Red Hat rating ImportantRed Hat Single Sign-On 7.2.4 security update
- Red Hat Single Sign-On 7.2.4 zip
- RHSA-2018:2425 Released 2018-08-15 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.1 security update
- Red Hat JBoss EAP 7.1
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| JBoss Developer Studio 11 | Affected | No fix planned: Will not fix |
| Red Hat AMQ Broker 7 | Affected | No fix yet |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux OpenStack Platform 7 (Kilo) Operational Tools | Affected | No fix planned: Will not fix |
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
| Red Hat JBoss A-MQ 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Virtualization 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Fuse Integration Service 2 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Operations Network 3 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Application Runtimes | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 10 (Newton) | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 11 (Ocata) | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 12 (Pike) | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 8 (Liberty) | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 9 (Mitaka) | Affected | No fix planned: Will not fix |
| Red Hat Software Collections | Affected | No fix planned: Will not fix |
| Red Hat JBoss EAP 7.1 | Fixed | RHSA-2018:2425 |
| Red Hat JBoss Enterprise Application Platform 6.4 | Fixed | RHSA-2018:2740 |
| Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 Server | Fixed | RHSA-2018:2742 |
| Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server | Fixed | RHSA-2018:2743 |
| Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server | Fixed | RHSA-2018:2741 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server | Fixed | RHSA-2018:2423 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server | Fixed | RHSA-2018:2424 |
| Red Hat JBoss Enterprise Application Platform Continuous Delivery | Fixed | RHSA-2020:2562 |
| Red Hat OpenShift Container Platform 3.11 | Fixed | RHSA-2019:3149 |
| Red Hat OpenShift Container Platform 4.1 | Fixed | RHSA-2019:2858 |
| Red Hat OpenStack Platform 13.0 | Fixed | RHSA-2018:2598 |
| Red Hat Satellite 6.4 | Fixed | RHSA-2018:2927 |
| Red Hat Satellite Capsule 6.4 | Fixed | RHSA-2018:2927 |
| Red Hat Single Sign-On 7.2.4 zip | Fixed | RHSA-2018:2428 |
| Red Hat Virtualization 4 Hypervisor for RHEL 7 | Fixed | RHSA-2018:2643 |
| Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts | Fixed | RHSA-2018:2643 |
Not affected: 10 products
- Red Hat BPM Suite 6
- Red Hat Enterprise Linux 8
- Red Hat JBoss BRMS 5
- Red Hat JBoss BRMS 6
- Red Hat JBoss Data Grid 7
- Red Hat Mobile Application Platform 4
- Red Hat OpenShift Container Platform 4
- Red Hat Single Sign-On 7
- Red Hat Software Collections
- streams for Apache Kafka
Timeline
- 2026-10-02 Threatist record created from CVE-2018-10237
- 2026-10-03 Alias added: GHSA-mvr2-9pj6-7w5j
- 2026-11-04 EPSS moved to the 95th–99th percentile
References
Patch 4
Advisory 15
- RHSA-2018:2428
- RHSA-2018:2740
- RHSA-2018:2741
- RHSA-2018:2742
- RHSA-2018:2598
- RHSA-2018:2643
- RHSA-2018:2424
- RHSA-2018:2423
- RHSA-2018:2425
- RHSA-2018:2927
- RHSA-2018:2743
- RHSA-2019:2858
- RHSA-2019:3149
- https://groups.google.com/d/topic/guava-announce/xqWALw4W1vs/discussion
- https://nvd.nist.gov/vuln/detail/CVE-2018-10237
Other 70
- [hadoop-hdfs-dev] 20190401 Update guava to 27.0-jre in hadoop-project
- [hadoop-common-dev] 20190401 Update guava to 27.0-jre in hadoop-project
- [pulsar-commits] 20190416 [GitHub] [pulsar] one70six opened a new issue #4057: Security Vulnerabilities - Black Duck Scan - Pulsar v.2.3.1
- [activemq-issues] 20190516 [jira] [Created] (AMQ-7208) Security Issue related to Guava 18.0
- [activemq-gitbox] 20190530 [GitHub] [activemq-artemis] brusdev opened a new pull request #2687: ARTEMIS-2359 Upgrade to Guava 24.1
- [cassandra-commits] 20190612 [jira] [Assigned] (CASSANDRA-14760) CVE-2018-10237 Security vulnerability in 3.11.3
- [activemq-issues] 20190820 [jira] [Created] (AMQ-7279) Security Vulnerabilities in Libraries - jackson-databind-2.9.8.jar, tomcat-servlet-api-8.0.53.jar, tomcat-websocket-api-8.0.53.jar, zookeeper-3.4.6.jar, guava-18.0.jar, jetty-all-9.2.26.v20180806.jar, scala-library-2.11.0.jar
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities
- [cxf-dev] 20200206 [GitHub] [cxf] davidkarlsen opened a new pull request #638: upgrade guava, CVE-2018-10237
- [cxf-dev] 20200206 [GitHub] [cxf] reta commented on a change in pull request #638: upgrade guava, CVE-2018-10237
- [cxf-dev] 20200211 [GitHub] [cxf] coheigea commented on a change in pull request #638: upgrade guava, CVE-2018-10237
- [kafka-users] 20200413 CVEs for the dependency software guava and rocksdbjni of Kafka
- [cxf-dev] 20200420 [GitHub] [cxf] coheigea commented on a change in pull request #638: upgrade guava, CVE-2018-10237
- [cxf-dev] 20200420 [GitHub] [cxf] reta commented on a change in pull request #638: upgrade guava, CVE-2018-10237
- [cxf-dev] 20200420 [GitHub] [cxf] andrei-ivanov commented on a change in pull request #638: upgrade guava, CVE-2018-10237
- [syncope-dev] 20200423 Re: Time to cut 2.1.6 / 2.0.15?
- [hadoop-common-dev] 20200623 Update guava to 27.0-jre in hadoop branch-2.10
- [flink-dev] 20200806 Dependency vulnerabilities with Apache Flink 1.10.1 version
- [flink-user] 20200806 Dependency vulnerabilities with Apache Flink 1.10.1 version
- [flink-dev] 20200806 [jira] [Created] (FLINK-18841) CVE-2018-10237 and CWE-400 occurred in flink dependency
- [flink-issues] 20200806 [jira] [Created] (FLINK-18841) CVE-2018-10237 and CWE-400 occurred in flink dependency
- [flink-issues] 20200814 [jira] [Commented] (FLINK-18841) CVE-2018-10237 and CWE-400 occurred in flink dependency
- [lucene-issues] 20201022 [jira] [Created] (SOLR-14960) Solr-clustering is bringing in CVE-2018-10237 vulnerable guava
- [lucene-issues] 20201022 [jira] [Updated] (SOLR-14960) Solr-clustering is bringing in CVE-2018-10237 vulnerable guava
- [lucene-issues] 20201022 [jira] [Resolved] (SOLR-14960) Solr-clustering is bringing in CVE-2018-10237 vulnerable guava
- [maven-issues] 20210122 [GitHub] [maven-indexer] akurtakov opened a new pull request #75: Remove guava dependency from indexer-core
- [flink-issues] 20210212 [jira] [Closed] (FLINK-18841) CVE-2018-10237 and CWE-400 occurred in flink dependency
- [samza-commits] 20210310 [GitHub] [samza] Telesia opened a new pull request #1471: SAMZA-2630: Upgrade dependencies for security fixes
- [storm-issues] 20210315 [jira] [Created] (STORM-3754) Upgrade Guava version because of security vulnerability
- [pulsar-commits] 20210406 [GitHub] [pulsar] lhotari opened a new pull request #10149: Upgrade jclouds to 2.3.0 to fix security vulnerabilities
- [arrow-github] 20210610 [GitHub] [arrow] projjal opened a new pull request #10501: ARROW-13032: Update guava version
- https://security.netapp.com/advisory/ntap-20220629-0008/
- https://lists.apache.org/thread.html/r223bc776a077d0795786c38cbc6e7dd808fce1a9161b00ba9c0a5d55@%3Cissues.lucene.apache.org%3E
- https://lists.apache.org/thread.html/r22c8173b804cd4a420c43064ba4e363d0022aa421008b1989f7354d4@%3Cissues.flink.apache.org%3E
- https://lists.apache.org/thread.html/r27eb79a87a760335226dbfa6a7b7bffea539a535f8e80c41e482106d@%3Cdev.cxf.apache.org%3E
- https://lists.apache.org/thread.html/r2ea4e5e5aa8ad73b001a466c582899620961f47d77a40af712c1fdf9@%3Cdev.cxf.apache.org%3E
- https://lists.apache.org/thread.html/r30e7d7b6bfa630dacc41649a0e96dad75165d50474c1241068aa0f94@%3Cissues.storm.apache.org%3E
- https://lists.apache.org/thread.html/r352e40ca9874d1beb4ad95403792adca7eb295e6bc3bd7b65fabcc21@%3Ccommits.samza.apache.org%3E
- https://lists.apache.org/thread.html/r38e2ab87528d3c904e7fac496e8fd766b9277656ff95b97d6b6b6dcd@%3Cdev.cxf.apache.org%3E
- https://lists.apache.org/thread.html/r3c3b33ee5bef0c67391d27a97cbfd89d44f328cf072b601b58d4e748@%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/r43491b25b2e5c368c34b106a82eff910a5cea3e90de82ad75cc16540@%3Cdev.syncope.apache.org%3E
- https://lists.apache.org/thread.html/r50fc0bcc734dd82e691d36d209258683141bfc0083739a77e56ad92d@%3Cdev.flink.apache.org%3E
- https://lists.apache.org/thread.html/r841c5e14e1b55281523ebcde661ece00b38a0569e00ef5e12bd5f6ba@%3Cissues.maven.apache.org%3E
- https://lists.apache.org/thread.html/r95799427b335807a4c54776908125c3e66597b65845ae50096d9278a@%3Cdev.cxf.apache.org%3E
- https://lists.apache.org/thread.html/ra0adb9653c7de9539b93cc8434143b655f753b9f60580ff260becb2b@%3Cusers.kafka.apache.org%3E
- https://lists.apache.org/thread.html/ra4f44016926dcb034b3b230280a18102062f94ae55b8a31bb92fed84@%3Cissues.lucene.apache.org%3E
- https://lists.apache.org/thread.html/ra8906723927aef2a599398c238eacfc845b74d812e0093ec2fc70a7d@%3Cissues.flink.apache.org%3E
- https://lists.apache.org/thread.html/rb3da574c34bc6bd37972d2266af3093b90d7e437460423c24f477919@%3Cissues.lucene.apache.org%3E
- https://lists.apache.org/thread.html/rc78f6e84f82cc662860e96526d8ab969f34dbe12dc560e22d9d147a3@%3Cdev.cxf.apache.org%3E
- https://lists.apache.org/thread.html/rc8467f357b943ceaa86f289f8bc1a5d1c7955b75d3bac1426f2d4ac1@%3Ccommon-dev.hadoop.apache.org%3E
- https://lists.apache.org/thread.html/rd01f5ff0164c468ec7abc96ff7646cea3cce6378da2e4aa29c6bcb95@%3Cgithub.arrow.apache.org%3E
- https://lists.apache.org/thread.html/rd0c8ec6e044aa2958dd0549ebf8ecead7f5968c9474ba73a504161b2@%3Cdev.cxf.apache.org%3E
- https://lists.apache.org/thread.html/rdc56c15693c236e31e1e95f847b8e5e74fc0a05741d47488e7fc8c45@%3Cissues.flink.apache.org%3E
- https://security.netapp.com/advisory/ntap-20220629-0008
- https://github.com/google/guava
- https://github.com/google/guava/wiki/CVE-2018-10237
- https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272@%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/19fa48533bc7ea1accf6b12746a74ed888ae6e49a5cf81ae4f807495@%3Ccommon-dev.hadoop.apache.org%3E
- https://lists.apache.org/thread.html/33c6bccfeb7adf644d4d79894ca8f09370be6ed4b20632c2e228d085@%3Ccommits.cassandra.apache.org%3E
- https://lists.apache.org/thread.html/3d5dbdd92ac9ceaef90e40f78599f9109f2f345252e0ac9d98e7e084@%3Cgitbox.activemq.apache.org%3E
- https://lists.apache.org/thread.html/3ddd79c801edd99c0978e83dbe2168ebd36fd42acfa5dac38fb03dd6@%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/cc48fe770c45a74dc3b37ed0817393e0c96701fc49bc431ed922f3cc@%3Chdfs-dev.hadoop.apache.org%3E
- https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E
- https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8@%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/r02e39d7beb32eebcdbb4b516e95f67d71c90d5d462b26f4078d21eeb@%3Cdev.flink.apache.org%3E
- https://lists.apache.org/thread.html/r02e39d7beb32eebcdbb4b516e95f67d71c90d5d462b26f4078d21eeb@%3Cuser.flink.apache.org%3E
Sources
- CVE-2018-10237 · CVE Program
- CVE-2018-10237 · NVD
- FIRST EPSS
- GHSA-mvr2-9pj6-7w5j · GitHub Advisory Database · CC BY 4.0
- CVE-2018-10237 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences