CVE-2018-10237

Name of the Vulnerable Software and Affected Versions: Google Guava versions 11.0 through 24.x before 24.1.1

Description: The issue is related to unbounded memory allocation in the AtomicDoubleArray and CompoundOrdering classes. This can be exploited by a remote attacker to conduct denial of service attacks against servers that rely on this library and deserialize attacker-provided data. The vulnerability arises because these classes perform eager allocation without proper checks on the data sent by a client and its size.

Recommendations: For Google Guava versions 11.0 through 24.x before 24.1.1, update to version 24.1.1 or later to resolve the issue. As a temporary workaround, consider restricting the deserialization of attacker-provided data to minimize the risk of exploitation. Additionally, restrict access to the AtomicDoubleArray and CompoundOrdering classes until the issue is resolved.