CVEvulnerability

CVE-2022-3509

7.5 HIGH Published 2022-12-12 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-12-12
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400

Description

A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.

Affected configurations

• google protobuf-java (>= 3.16.0 < 3.16.3) • google protobuf-java (>= 3.19.0 < 3.19.6) • google protobuf-java (>= 3.20.0 < 3.20.3) • google protobuf-java (>= 3.21.0 < 3.21.7) • google protobuf-javalite (>= 3.16.0 < 3.16.3) • google protobuf-javalite (>= 3.17.0 < 3.19.6) • google protobuf-javalite (>= 3.20.0 < 3.20.3) • google protobuf-javalite (>= 3.21.0 < 3.21.7)

Related

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References