VULNpocalypse

CVE-2018-10237: vulnerability

Advisory generated from the CVE record, CISA, Exploit Observer and VEDAS: what it is, whether it is exploited, who is affected, and how to fix and detect it.

Generated by VEDAS. Scores as of 2026-11-04 15:41 UTC. Rebuilt every few hours from cve-scores, CISA KEV and vedas-signatures. How this works and its limits.

What it is

Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.

Description quoted from the CVE record (assigned by mitre, published 2018-04-26).

How it can be exploited

Public exploit evidence (Exploit Observer)

Exploit Observer has no public exploit code naming this CVE. Check Exploit Observer for anything new.

Live scores

EPSS
0.084
some chance of attack soon
VEDAS
0.987
strong exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

Who is affected

ProductAffectedNot affected
Not statedversions not stated in the recordNot stated

Version ranges exactly as the CVE record states them. “Before X” means X is the first fixed version.

How to fix it

Vendor guidance:

5 more

How to detect it

There is no open VEDAS detection rule for this bug yet. It is listed on the detection gaps page if CISA has confirmed attacks.

References

Vendor advisories and patches

1 more

Other references

28 more

Other databases

Where this comes from

This advisory is generated automatically by VEDAS from: CVE.org record, cve-scores (EPSS and VEDAS), Exploit Observer. Text in quotes is reproduced from the source; everything else is a fixed template filled with source fields. Nothing here is written by a language model. Check the vendor advisory before acting, and read how VEDAS and Exploit Observer work, and their limits.

Supporting partners

Feasible SecurityAskealGoTrust