Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-3171

A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.

Published

2022-10-12T23:15:09.807

Last Modified

2024-11-21T07:18:58.277

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 4.3 (MEDIUM)

Weaknesses
  • Type: Secondary
    CWE-20
  • Type: Primary
    NVD-CWE-noinfo
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application google google-protobuf < 3.16.3 Yes
Application google google-protobuf < 3.19.6 Yes
Application google google-protobuf < 3.20.3 Yes
Application google google-protobuf < 3.21.7 Yes
Application google protobuf-java < 3.16.3 Yes
Application google protobuf-java < 3.19.6 Yes
Application google protobuf-java < 3.20.3 Yes
Application google protobuf-java < 3.21.7 Yes
Application google protobuf-javalite < 3.16.3 Yes
Application google protobuf-javalite < 3.19.6 Yes
Application google protobuf-javalite < 3.20.3 Yes
Application google protobuf-javalite < 3.21.7 Yes
Application google protobuf-kotlin < 3.16.3 Yes
Application google protobuf-kotlin < 3.19.6 Yes
Application google protobuf-kotlin < 3.20.3 Yes
Application google protobuf-kotlin < 3.21.7 Yes
Application google protobuf-kotlin-lite < 3.16.3 Yes
Application google protobuf-kotlin-lite < 3.19.6 Yes
Application google protobuf-kotlin-lite < 3.20.3 Yes
Application google protobuf-kotlin-lite < 3.21.7 Yes
Operating System fedoraproject fedora 37 Yes
References