Sign in
Deutsch English Español Polski
High

Protobuf Java vulnerable to Uncontrolled Resource Consumption

  • Disclosed: 12.12.2022
  • Updated: 11.10.2026 13:19

A parsing issue similar to CVE-2022-3171, but with Message-Type Extensions in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Java / Kotlin (Maven) com.google.protobuf:protobuf-java >= 3.0.0, < 3.16.3, >= 3.17.0, < 3.19.6, >= 3.20.0, < 3.20.3, >= 3.21.0, < 3.21.7 3.16.3, 3.19.6, 3.20.3, 3.21.7
Java / Kotlin (Maven) com.google.protobuf:protobuf-javalite >= 3.0.0, < 3.16.3, >= 3.17.0, < 3.19.6, >= 3.20.0, < 3.20.3, >= 3.21.0, < 3.21.7 3.16.3, 3.19.6, 3.20.3, 3.21.7

References

CVSS score 7.5/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE)
CWE-400
Platform
Java / Kotlin (Maven)
Package
com.google.protobuf:protobuf-java, com.google.protobuf:protobuf-javalite
Disclosed
12.12.2022
Updated
11.10.2026 13:19

Sources and licenses

OSV / GitHub Advisory Database - GHSA-4gg5-vx3j-xwc7 - CC BY 4.0

Vulnerability history: com.google.protobuf:protobuf-java

All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.

Total entries
6
First → latest
01.2022 09.2024
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • High 5
  • Medium 1

Disclosures per year

  1. protobuf-java has potential Denial of Service issue
    High · 7.5 CVE-2024-7254 < 3.25.5, >= 4.0.0-RC1, < 4.27.5, >= 4.28.0-RC1, < 4.28.2 3.25.5, 4.27.5, 4.28.2
  2. Protobuf Java vulnerable to Uncontrolled Resource Consumption
    High · 7.5 CVE-2022-3509 >= 3.0.0, < 3.16.3, >= 3.17.0, < 3.19.6, >= 3.20.0, < 3.20.3, >= 3.21.0, < 3.21.7 3.16.3, 3.19.6, 3.20.3, 3.21.7
  3. Protobuf Java vulnerable to Uncontrolled Resource Consumption this entry
    High · 7.5 CVE-2022-3510 >= 3.0.0, < 3.16.3, >= 3.17.0, < 3.19.6, >= 3.20.0, < 3.20.3, >= 3.21.0, < 3.21.7 3.16.3, 3.19.6, 3.20.3, 3.21.7
  4. protobuf-java has a potential Denial of Service issue
    Medium · 5.7 CVE-2022-3171 >= 3.21.0-rc-1, < 3.21.7, >= 3.20.0-rc-1, < 3.20.3, >= 3.17.0-rc-1, < 3.19.6, < 3.16.3 3.21.7, 3.20.3, 3.19.6, 3.16.3
  5. Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error me
    High · 7.5 CVE-2021-22570 < 3.15.0 3.15.0
  6. A potential Denial of Service issue in protobuf-java
    High · 7.5 CVE-2021-22569 < 3.16.1, >= 3.18.0, < 3.18.2, >= 3.19.0, < 3.19.2 3.16.1, 3.18.2, 3.19.2

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.