CVE-2023-2976: Insecure Use of Temporary Directory in Google Guava
Summary
CVE-2023-2976: Guava vulnerable to insecure use of temporary directory. Affects com.google.guava:guava versions >= 1.0, < 32.0.0-android. Fixed in 32.0.0-android. How to fix ↓
Also tracked for
- guava-libraries · Debian:11
The same CVE-2023-2976 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Google Guava is an open-source Java library that provides a set of utility classes and methods for common programming tasks. It is widely used in various Java applications and frameworks. The vulnerability identified as CVE-2023-2976 affects Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich. This vulnerability arises from the insecure use of the default temporary directory in the FileBackedOutputStream class. It allows other users and apps with access to the default Java temporary directory to access the files created by this class.
Vulnerability Detail
The vulnerability in Google Guava arises from the use of Java's default temporary directory for file creation in the FileBackedOutputStream class. This means that any files created by this class are stored in a location that is accessible to other users and apps on the same machine with access to the default Java temporary directory. This can lead to unauthorized access and potential misuse of sensitive information. The vulnerability has a CVSS score of 5.5, indicating a moderate severity level.
How To Fix
Latest published version: 33.7.2-jre as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
32.0.0-android
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to a fixed version of Google Guava.
Conclusion
The vulnerability in Google Guava (CVE-2023-2976) allows unauthorized access to files created by the FileBackedOutputStream class. To mitigate this risk, it is crucial to upgrade to a fixed version of Google Guava, preferably version 32.0.1. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.google.guava:guava →
FAQ
Google Guava is an open-source Java library that provides utility classes and methods for common programming tasks.
The vulnerability affects Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich.
The vulnerability allows other users and apps with access to the default Java temporary directory to access files created by the FileBackedOutputStream class, potentially leading to unauthorized access and misuse of sensitive information.
The CVSS score of this vulnerability is 5.5, indicating a moderate severity level.
To fix this vulnerability, it is recommended to upgrade to Google Guava version 32.0.1 or a higher version.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.google.guava:guava.
