# com.google.guava:guava (Maven) vulnerabilities

4 known vulnerabilities (1 high, 1 medium, 1 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 33.8.0-jre (Nov 2, 2026): no advisory with comparable ranges affects it; 1 advisory (CVE-2020-8908) can't be checked against versions
- Newest unaffected release: 33.8.0-jre (Nov 2, 2026), the latest release, not counting 1 advisory without comparable ranges
- Dependents: 5,436
- Releases: 156 since 10.0 (Sep 28, 2011)
- Registry: https://central.sonatype.com/artifact/com.google.guava/guava
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2026-102554: 10.0-rc1 to 33.7.1-jre (33.7.2-android is outside it)
- CVE-2023-2976: 10.0-rc1 to 31.1-jre (32.0.0-android is outside it)
- CVE-2020-8908: its ranges can't be placed on these versions
- CVE-2018-10237: 11.0 to 24.1-jre (24.1.1-android is outside it)

## Advisories (4)

### [CVE-2026-102554](https://cve.now/CVE-2026-102554): Denial of Service via Eager Array Allocation During Deserialization in Guava

- Severity: High 8.2
- Published: Oct 9, 2026
- Affected: from 4.0, fixed in 33.7.2.
- Fixed in 33.7.2-android (released Sep 29, 2026, 10 days before disclosure, the advisory names 33.7.2, which was never published).
- The latest release, 33.8.0-jre, is not affected.

### [CVE-2023-2976](https://cve.now/CVE-2023-2976): Use of temporary directory for file creation in \`FileBackedOutputStream\` in Guava

- Severity: Medium 5.5
- Published: Jun 14, 2023
- Affected: from 1.0, fixed in 32.0.0-android.
- Fixed in 32.0.0-android (released May 26, 2023, 19 days before disclosure).
- The latest release, 33.8.0-jre, is not affected.

### [CVE-2020-8908](https://cve.now/CVE-2020-8908): Temp directory permission issue in Guava

- Severity: Low 3.3
- Published: Dec 10, 2020
- Affected: fixed in 32.0.0-android.

### [CVE-2018-10237](https://cve.now/CVE-2018-10237): Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks…

- Severity: Unrated
- Published: Apr 26, 2018
- Affected: from 11.0, fixed in 24.1.1-android.
- Fixed in 24.1.1-android (released Apr 26, 2018, the day of disclosure).
- The latest release, 33.8.0-jre, is not affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/com.google.guava:guava
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.