Which products and versions are affected by CVE-2010-4476?

Affected: Jdk (Sun) versions 1.5.0, 1.5.0-update1, 1.5.0-update10, 1.5.0-update11, 1.5.0-update12, 1.5.0-update13, 1.5.0-update14, 1.5.0-update15; Jre (Sun) versions 1.4.2, 1.4.2_1, 1.4.2_10, 1.4.2_11, 1.4.2_12, 1.4.2_13, 1.4.2_14, 1.4.2_15; Sdk (Sun) versions 1.4.2, 1.4.2_02, 1.4.2_1, 1.4.2_10, 1.4.2_11, 1.4.2_12, 1.4.2_13, 1.4.2_14, among others. The full list is in the CVE brief.

Is CVE-2010-4476 being exploited in the wild?

It is not listed in any known-exploited vulnerabilities catalog.

Is CVE-2010-4476 in the CISA KEV catalog?

No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Is there a public exploit for CVE-2010-4476?

A public exploit is reported by tracking sources, but no code link is listed yet.

Is there a fix for CVE-2010-4476?

Fixed versions are available, including java 1.4.2-ibm-0:1.4.2.13.8-1jpp.4.el4, java 1.5.0-ibm-1:1.5.0.12.3-1jpp.3.el6, java 1.6.0-ibm-1:1.6.0.9.1-1jpp.1.el5.

How urgently should CVE-2010-4476 be patched?

Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.

Request A Demo

WatchlistMedium

CVE-2010-4476Jre Vulnerability

Apache Tomcat affected by infinite loop in Double.parseDouble method in Java Runtime Environment

Published May 14, 2022 · Updated Mar 9, 2026 · Also known as DEBIAN-CVE-2010-4476, DSA-2161-1, DSA-2161-2, GHSA-gvgc-rxmh-5hvw

Key Facts

Routine patching

CVE-2010-4476 is a medium-severity vulnerability (CVSS 5.0 v2) affecting Jdk (Sun), Jre (Sun), Sdk (Sun) and 22 more products.
It is not listed in any known-exploited vulnerabilities catalog. A public exploit is reported by tracking sources, but no code link is listed yet.
EPSS estimates a 23% probability of exploitation in the next 30 days.
Fixed versions are available, including java 1.4.2-ibm-0:1.4.2.13.8-1jpp.4.el4, java 1.5.0-ibm-1:1.5.0.12.3-1jpp.3.el6, java 1.6.0-ibm-1:1.6.0.9.1-1jpp.1.el5.
Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.

Scores

CVSS v2

5.0

AV:N/AC:L/Au:N/C:N/I:N/A:P

EPSS (30-day exploit likelihood)

23%

Higher than 97.7% of all scored CVEs

Exploit maturity

Proof of concept

ATLAS score

34/100

Publication score, see How it works

Exploitation Verdict

KEV listed

Not listed

Federal due date

None

No federal due date

Ransomware use

Not reported

Attributed actors

None named

Exploit & Defence Guidance

Exploit maturity

Proof of concept

Public exploit code

Proof-of-concept links

In-the-wild evidence

Reports of active use

Advisories And Exploit References

advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2010-4476
advisoryRHSA-2011:0210
advisoryRHSA-2011:0211
advisoryRHSA-2011:0212
advisoryRHSA-2011:0213
advisoryRHSA-2011:0214

Description

The Double.parseDouble method in Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 and earlier, as used in OpenJDK, Apache, JBossweb, and other products, allows remote attackers to cause a denial of service via a crafted string that triggers an infinite loop of estimations during conversion to a double-precision binary floating-point number, as demonstrated using 2.2250738585072012e-308.

Affected Products

204 affected entries in total

Product	Affected versions	Fixed in
JdkSun	1.5.0, 1.5.0-update1, 1.5.0-update10, 1.5.0-update11, 1.5.0-update12, 1.5.0-update13, 1.5.0-update14, 1.5.0-update15	1.6.0
JreSun	1.4.2, 1.4.2_1, 1.4.2_10, 1.4.2_11, 1.4.2_12, 1.4.2_13, 1.4.2_14, 1.4.2_15	1.4.2_29
SdkSun	1.4.2, 1.4.2_02, 1.4.2_1, 1.4.2_10, 1.4.2_11, 1.4.2_12, 1.4.2_13, 1.4.2_14	1.4.2_29
openjdk-6debian	See advisory	6b18-1.8.3-2+squeeze1
org.apache.tomcat:tomcatmaven	>= 7.0.0	5.5.33

20 more affected products in the full CVE brief

Patched Releases

java

1.4.2-ibm-0:1.4.2.13.8-1jpp.4.el4, 1.5.0-ibm-1:1.5.0.12.3-1jpp.3.el6, 1.6.0-ibm-1:1.6.0.9.1-1jpp.1.el5

java-1.6.0-openjdk