Alta

A potential Denial of Service issue in protobuf-java

Publicada: 07.01.2022
Actualizado: 11.10.2026 13:19

Summary

A potential Denial of Service issue in protobuf-java was discovered in the parsing procedure for binary data.

Affected versions: All versions of Java Protobufs (including Kotlin and JRuby) prior to the versions listed below. Protobuf "javalite" users (typically Android) are not affected.

Severity

CVE-2021-22569 High - CVSS Score: 7.5, An implementation weakness in how unknown fields are parsed in Java. A small (~800 KB) malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated GC pauses.

Proof of Concept

For reproduction details, please refer to the oss-fuzz issue that identifies the specific inputs that exercise this parsing weakness.

Remediation and Mitigation

Please update to the latest available versions of the following packages:

protobuf-java (3.16.1, 3.18.2, 3.19.2)
protobuf-kotlin (3.18.2, 3.19.2)
google-protobuf [JRuby gem only] (3.19.2)

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

Plataforma	Paquete	Versiones vulnerables	Corregida en
Java / Kotlin (Maven)	com.google.protobuf:protobuf-java	< 3.16.1, >= 3.18.0, < 3.18.2, >= 3.19.0, < 3.19.2	3.16.1, 3.18.2, 3.19.2
Java / Kotlin (Maven)	com.google.protobuf:protobuf-kotlin	>= 3.18.0, < 3.18.2, >= 3.19.0, < 3.19.2	3.18.2, 3.19.2

Referencias

Puntuación CVSS 7.5/10

Vector CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Debilidad (CWE): CWE-696
Plataforma: Java / Kotlin (Maven)
Paquete: com.google.protobuf:protobuf-java, com.google.protobuf:protobuf-kotlin
Publicada: 07.01.2022
Actualizado: 11.10.2026 13:19

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-wrvw-hg22-4m67 - CC BY 4.0

Historial de vulnerabilidades: com.google.protobuf:protobuf-java

Todas las vulnerabilidades publicadas de este paquete (Java / Kotlin (Maven)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Entradas en total: 6
Primera → última: 01.2022 09.2024
Sin corrección: 0
Explotada en ataques: 0

Distribución por gravedad

Alta 5
Media 1

Divulgaciones por año

2022: 5
2023: 0
2024: 1
2025: 0
2026: 0

19.09.2024

protobuf-java has potential Denial of Service issue

Alta · 7.5 CVE-2024-7254 < 3.25.5, >= 4.0.0-RC1, < 4.27.5, >= 4.28.0-RC1, < 4.28.2 3.25.5, 4.27.5, 4.28.2
12.12.2022

Protobuf Java vulnerable to Uncontrolled Resource Consumption

Alta · 7.5 CVE-2022-3509 >= 3.0.0, < 3.16.3, >= 3.17.0, < 3.19.6, >= 3.20.0, < 3.20.3, >= 3.21.0, < 3.21.7 3.16.3, 3.19.6, 3.20.3, 3.21.7
12.12.2022

Protobuf Java vulnerable to Uncontrolled Resource Consumption

Alta · 7.5 CVE-2022-3510 >= 3.0.0, < 3.16.3, >= 3.17.0, < 3.19.6, >= 3.20.0, < 3.20.3, >= 3.21.0, < 3.21.7 3.16.3, 3.19.6, 3.20.3, 3.21.7
04.10.2022

protobuf-java has a potential Denial of Service issue

Media · 5.7 CVE-2022-3171 >= 3.21.0-rc-1, < 3.21.7, >= 3.20.0-rc-1, < 3.20.3, >= 3.17.0-rc-1, < 3.19.6, < 3.16.3 3.21.7, 3.20.3, 3.19.6, 3.16.3
26.01.2022

Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error me

Alta · 7.5 CVE-2021-22570 < 3.15.0 3.15.0
07.01.2022

A potential Denial of Service issue in protobuf-java esta entrada

Alta · 7.5 CVE-2021-22569 < 3.16.1, >= 3.18.0, < 3.18.2, >= 3.19.0, < 3.19.2 3.16.1, 3.18.2, 3.19.2

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación