Unbounded Memory Allocation Vulnerability in Google Guava Library

CVE-2018-10237

Summary

The Google Guava library, specifically versions 11.0 to 24.x prior to 24.1.1, is susceptible to unbounded memory allocation, which can be exploited by remote attackers. The vulnerability stems from improper checks when deserializing data, particularly through the AtomicDoubleArray and CompoundOrdering classes. This design flaw allows attackers to send carefully crafted data that can cause denial of service by exhausting server resources, compromising the availability of applications that rely on this library.

References