CVEvulnerability

CVE-2022-3171

7.5 HIGH Published 2022-10-12 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-10-12
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.3 MEDIUM — CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-20

Description

A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.

Affected configurations

• google google-protobuf (< 3.16.3) • google google-protobuf (>= 3.17.0 < 3.19.6) • google google-protobuf (>= 3.20.0 < 3.20.3) • google google-protobuf (>= 3.21.0 < 3.21.7) • google protobuf-java (< 3.16.3) • google protobuf-java (>= 3.17.0 < 3.19.6) • google protobuf-java (>= 3.20.0 < 3.20.3) • google protobuf-java (>= 3.21.0 < 3.21.7) • google protobuf-javalite (< 3.16.3) • google protobuf-javalite (>= 3.17.0 < 3.19.6) • google protobuf-javalite (>= 3.20.0 < 3.20.3) • google protobuf-javalite (>= 3.21.0 < 3.21.7) • google protobuf-kotlin (< 3.16.3) • google protobuf-kotlin (>= 3.17.0 < 3.19.6) • google protobuf-kotlin (>= 3.20.0 < 3.20.3) • google protobuf-kotlin (>= 3.21.0 < 3.21.7) • google protobuf-kotlin-lite (< 3.16.3) • google protobuf-kotlin-lite (>= 3.17.0 < 3.19.6) • google protobuf-kotlin-lite (>= 3.20.0 < 3.20.3) • google protobuf-kotlin-lite (>= 3.21.0 < 3.21.7) • fedoraproject fedora 37

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References