Denial of Service Vulnerability in Guava Libraries: Unbounded Memory Allocation
Summary
CVE-2018-10237: Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data,... Affects guava-libraries across 2 version ranges.
>= 5a6bf80c7403d77df18adb41b5b15ea34d28186d, < 49fad5af840b2a28dd0dc24ecfd58b4baa8d67bc
< 29.0-1
Fixed in 29.0-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Guava is a set of core libraries for Java, developed by Google, that provides collections, caching, primitives support, concurrency libraries, common annotations, string processing, I/O, and more. It is widely used in Java applications for its robust features and ease of use. However, certain versions of Guava are susceptible to a vulnerability that allows attackers to exploit unbounded memory allocation during deserialization, potentially leading to denial of service attacks.
Vulnerability Detail
The vulnerability, identified as CVE-2018-10237, arises from unbounded memory allocation in the AtomicDoubleArray and CompoundOrdering classes when serialized using Java and GWT serialization, respectively. This flaw allows remote attackers to send specially crafted data that can cause the application to allocate excessive memory, leading to denial of service. The vulnerability affects versions of Guava from 11.0 to 24.x before 24.1.1, making it critical for applications relying on these versions to address the issue promptly.
How To Fix
Minimum fixed version
29.0-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade guava-librariesTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately feasible, consider implementing input validation to check the size and structure of incoming serialized data before deserialization. This can help mitigate the risk of denial of service by rejecting overly large or malformed data. Additionally, you can limit the memory available to your application using JVM options such as -Xmx to set a maximum heap size.
Conclusion
CVE-2018-10237 is a significant vulnerability in the Guava libraries that can lead to denial of service through unbounded memory allocation. It is crucial for developers using affected versions to upgrade to a secure version or implement workarounds to protect their applications. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for guava-libraries →
FAQ
CVE-2018-10237 is a vulnerability in the Guava libraries that allows for unbounded memory allocation during deserialization, potentially leading to denial of service.
The vulnerability affects Guava versions from 11.0 to 24.x before 24.1.1.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
If exploited, this vulnerability can lead to denial of service, causing your application to become unresponsive due to excessive memory allocation.
The CVSS score for CVE-2018-10237 is 5.9, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for guava-libraries.
