Google Guava vulnerabilities

4 CVEs affecting Google Guava, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-102554, published 2026-10-09.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-10237, published 2018-04-26. Medium severity, CVSS 5.9. EPSS: 5.1% chance of exploitation in the next 30 days. Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize…
CVE-2020-8908, published 2020-12-10. Low severity, CVSS 3.3. EPSS: 0.9% chance of exploitation in the next 30 days. A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API…
CVE-2026-102554, published 2026-10-09. High severity, CVSS 8.2. EPSS: 0.4% chance of exploitation in the next 30 days. Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via…
CVE-2023-2976, published 2023-06-14. High severity, CVSS 7.1. EPSS: 0.2% chance of exploitation in the next 30 days. Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps…