Guava

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Product vulnerability (Tier OT0; supply-chain compromise is a separate category) │ $500 - $7,500 │ $625 - $8,500 Other security issue (Tier OT0 flat award) │ $1,000 │ $1,250 Submit a vulnerability CVE history 0 Last 12 months 3 Lifetime Info disclosure 40 % Access control 25 % Denial of service 22 % Parsing/validation 8 % Latest advisories Loading the feed Overview Guava is among the two or three most-depended-upon artifacts on Maven Central, on the classpath of a very large fraction of production Java: Hadoop, Spark, Hive, Cassandra, Jenkins plugins, Android applications and effectively every Google Java client library. Its footprint is closer to "part of the Java platform in practice" than to a library, which is why its two real CVEs, world-readable temporary directories created by Files.createTempDir , found once and then again as an incomplete-fix follow-up, each required an ecosystem-wide upgrade wave to remediate. The interesting property for a bounty hunter is the asymmetry: an enormous deployment base against only three CVEs in fifteen years. Google pays for it through the Bug Hunters open-source VRP at Tier OT0, where a product vulnerability in the project's own code runs from $500 to $7,500 at a panel's discretion. sorona.xyz adds 1.25× on top of whatever Google awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope Google's open-source VRP takes security issues in the latest versions of the code held in the repositories it lists, and google/guava is named in the published tier file at TIER_OT0: a product vulnerability anywhere in the library's own code is accepted, at $500 to $7,500 The whole com.google.common package tree as shipped in the com.google.guava:guava artifact, in both the JRE and Android flavours com.google.common.base with escape , html and xml : Splitter , Joiner , CharMatcher and the escapers, all of which downstream code treats as an output-safety boundary com.google.common.net : InternetDomainName , HostSpecifier , MediaType , HttpHeaders , InetAddresses and UrlEscapers , the types callers reach for when they have to validate an untrusted host or URL com.google.common.io and com.google.common.hash : byte and stream handling, file and temporary-directory creation with the permissions Guava sets on it, and the hash functions com.google.common.collect with primitives , math and graph : the data structures and their bounds, overflow and ordering behaviour, including whatever is reachable when Java deserialises those types com.google.common.cache , util.concurrent , eventbus and reflect : LoadingCache and eviction, ListenableFuture and the service state machines, event dispatch, and runtime type inspection The repository itself and the Maven Central release pipeline for com.google.guava:guava , which Google prices under its separate supply-chain category Out of scope Applications that use Guava insecurely, as opposed to defects in Guava's own behaviour @Beta -annotated APIs, where the project states the contract is explicitly unstable Differences between the guava and guava-android artifacts that carry no independent security impact Gradle and Maven consumer configuration problems on the integrator's side Performance regressions and non-security behaviour changes Repositories in Google's GitHub orgs that the tier file does not list, which pay nothing for a product vulnerability after the April 2026 rules update Defects that only reproduce on a release the project no longer ships, since the program covers the latest versions Reports filed by anyone other than the finder: Google wants the submission through bughunters.google.com under the researcher's own identity, and it does not pay Google or Google Partner employees Rewards to researchers on a sanctions list, in a sanctioned territory, or located in Russia or Belarus, which Google states it cannot issue Most-valued findings A local file-permission or temporary-path defect in com.google.common.io that exposes data to other users on the same host: this is the exact shape of both of Guava's real CVEs and the reason info disclosure is 40% of its history, and it is the class most likely to reach the top of the $7,500 band An escaping or parsing flaw in UrlEscapers , InternetDomainName or HostSpecifier that makes a hostile host or URL validate, since callers use those types as a security boundary before making a request Unbounded allocation in a collection or ordering deserialisation path, the CVE-2018-10237 shape, reachable wherever a service accepts serialised Java state Cache behaviour under adversarial load that lets one caller read or evict another caller's entry, which is where the 25% access-control share would land An escaping utility in com.google.common.base that silently drops or mishandles a character class, because downstream code treats its output as already safe Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. The repo is rated TIER_OT0, where product vulnerabilities cap at $7,500; the $31,337 ceiling requires a supply-chain compromise of the repository or release pipeline, which is a different reward category Guava is pure Java, so the OSS-Fuzz memory-corruption gate does not apply: a reproducible test case against a released artifact is the right proof The award is set by a discretionary panel, so the band is a range rather than a fixed table and a report that spells out real impact is what moves you up it Show the defect in Guava itself rather than in a caller: an application that uses a Guava API unsafely is out of scope even where the outcome looks identical Take the flaw to Google before anyone else: the VRP treats private disclosure to a third party for purposes other than fixing the bug as grounds to refuse the reward Disclosure Coordinated through Google Bug Hunters, with the fix shipping in a Guava release and an advisory published against the com.google.guava:guava Maven coordinate. Because the program's rules can be read as barring a third-party hand-off before the fix, file with Google directly and hold the detail until the release is out: remediation here is an ecosystem-wide upgrade wave and needs the lead time. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability