MavenPackage

com.google.guava:guava

4 known vulnerabilities (1 high, 1 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release: 33.8.0-jre (Nov 2, 2026): no advisory with comparable ranges affects it; 1 advisory (CVE-2020-8908) can't be checked against versions
Newest unaffected release: 33.8.0-jre (Nov 2, 2026), the latest release, not counting 1 advisory without comparable ranges
Advisories: 4 · 1 high, 1 medium, 1 low

Version timeline

CVE-2026-102554
Affects 10.0-rc1 to 33.7.1-jre (33.7.2-android is outside it)
CVE-2023-2976
Affects 10.0-rc1 to 31.1-jre (32.0.0-android is outside it)
CVE-2020-8908
Its ranges can't be placed on these versions
Its ranges can't be placed on these versions
CVE-2018-10237
Affects 11.0 to 24.1-jre (24.1.1-android is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-102554High 8.2
Denial of Service via Eager Array Allocation During Deserialization in Guava
Affected: from 4.0, fixed in 33.7.2.
Fixed in 33.7.2-android (released Sep 29, 2026, 10 days before disclosure, the advisory names 33.7.2, which was never published).
The latest release, 33.8.0-jre, is not affected.
CVE-2023-2976Medium 5.5
Use of temporary directory for file creation in `FileBackedOutputStream` in Guava
Affected: from 1.0, fixed in 32.0.0-android.
Fixed in 32.0.0-android (released May 26, 2023, 19 days before disclosure).
The latest release, 33.8.0-jre, is not affected.
CVE-2020-8908Low 3.3
Temp directory permission issue in Guava
Affected: fixed in 32.0.0-android.
CVE-2018-10237Unrated
Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks…
Affected: from 11.0, fixed in 24.1.1-android.
Fixed in 24.1.1-android (released Apr 26, 2018, the day of disclosure).
The latest release, 33.8.0-jre, is not affected.