Fluid Attacks Database

Description

Protobuf Java vulnerable to Uncontrolled Resource Consumption A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 14	protobuf	>=0 <3.21.9-3	3.21.9-3
maven	com.google.protobuf:protobuf-java	>=3.0.0 <3.16.3 \|\| >=3.17.0 <3.19.6 \|\| >=3.20.0 <3.20.3 \|\| >=3.21.0 <3.21.7	3.16.3, 3.19.6, 3.20.3, 3.21.7
debian 13	protobuf	>=0 <3.21.9-3	3.21.9-3
maven	com.google.protobuf:protobuf-javalite	>=3.20.0 <3.20.3 \|\| >=3.21.0 <3.21.7 \|\| >=3.0.0 <3.16.3	3.20.3, 3.21.7, 3.16.3
debian 12	protobuf	>=0 <3.21.9-3	3.21.9-3

Aliases

1. CVE-2022-35092. NVD-2022-35093. OSV-DEBIAN-2022-35094. OSV-2022-35095. GCVE-2022-35096. SECURITY-TRACKER-CVE-2022-3509

References

1. https://github.com/protocolbuffers/protobuf/commit/a3888f53317a8018e7a439bac4abeb8f3425d5e92. https://github.com/protocolbuffers/protobuf/blob/v2.6.1/java/core/src/main/java/com/google/protobuf/MessageReflection.java3. https://github.com/protocolbuffers/protobuf/blob/v3.0.0/java/core/src/main/java/com/google/protobuf/MessageReflection.java

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.