What is the CVSS score of CVE-2018-10237?

CVE-2018-10237 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 5.1%.

Is there a patch available for CVE-2018-10237?

Yes, a patch is available for CVE-2018-10237. Update the affected software to the latest version immediately.

Java CVE-2018-10237

MEDIUM

Allocation of Resources Without Limits or Throttling (CWE-770)

2018-04-26 cve@mitre.org

Google Java Denial Of Service Guava Openshift Container Platform Openstack Satellite Satellite Capsule Virtualization Virtualization Host Jboss Enterprise Application Platform Banking Payments Communications Ip Service Activator Customer Management And Segmentation Foundation Database Server Flexcube Investor Servicing Flexcube Private Banking Retail Integration Bus Retail Xstore Point Of Service Weblogic Server

5.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVE Published

Apr 26, 2018 - 21:29 nvd

MEDIUM 5.9

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

525 maven packages depend on com.google.guava:guava (148 direct, 379 indirect)
772 maven packages depend on com.google.guava:guava-jdk5 (34 direct, 746 indirect)
78 maven packages depend on com.googlecode.guava-osgi:guava-osgi (10 direct, 68 indirect)
11 maven packages depend on org.hudsonci.lib.guava:guava (5 direct, 6 indirect)

Ecosystem-wide dependent count for version 11.0 and other introduced versions.

DescriptionNVD

Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.

AnalysisAI

Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.

Technical ContextAI

This vulnerability is classified as Allocation of Resources Without Limits (CWE-770), which allows attackers to exhaust system resources through uncontrolled allocation. Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable. Affected products include: Google Guava, Redhat Openshift Container Platform, Redhat Openstack, Redhat Satellite, Redhat Satellite Capsule. Version information: through 24..

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Set resource limits, implement rate limiting, validate input sizes.