GHSA-4gg5-vx3j-xwc7HighCVSS 7.5

Protobuf Java vulnerable to Uncontrolled Resource Consumption

Published
December 12, 2022
Last Modified
September 2, 2025

🔗 CVE IDs covered (1)

CVE-2022-3510 →

📋 Description

A parsing issue similar to CVE-2022-3171, but with Message-Type Extensions in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.

🎯 Affected products8

  • maven/com.google.protobuf:protobuf-java:>= 3.17.0, < 3.19.6
  • maven/com.google.protobuf:protobuf-java:>= 3.20.0, < 3.20.3
  • maven/com.google.protobuf:protobuf-java:>= 3.21.0, < 3.21.7
  • maven/com.google.protobuf:protobuf-javalite:>= 3.17.0, < 3.19.6
  • maven/com.google.protobuf:protobuf-javalite:>= 3.20.0, < 3.20.3
  • maven/com.google.protobuf:protobuf-javalite:>= 3.21.0, < 3.21.7
  • maven/com.google.protobuf:protobuf-java:>= 3.0.0, < 3.16.3
  • maven/com.google.protobuf:protobuf-javalite:>= 3.0.0, < 3.16.3

🔗 References (3)