CVE-2022-3171
- Source
- https://cve.org/CVERecord?id=CVE-2022-3171
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-3171.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2022-3171
- Aliases
- Downstream
- Related
- Published
- 2022-10-12T23:15:09.807Z
- Modified
- 2026-02-03T08:03:02.874432Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.
- References
-
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CBAUKJQL6O4TIWYBENORSY5P43TVB4M3/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MPCGUT3T5L6C3IDWUPSUO22QDCGQKTOP/
- https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-h4h5-3hr4-j3g2
- https://security.gentoo.org/glsa/202301-09
Affected packages
Git / github.com/protocolbuffers/protobuf
Affected ranges
- Type
- GIT
- Repo
- https://github.com/protocolbuffers/protobuf
- Events
-
IntroducedFixedIntroducedFixedFixedIntroducedFixed
Affected versions
v3.*
v3.16.0
v3.16.0-rc1
v3.16.0-rc2
v3.17.0
v3.17.1
v3.17.2
v3.17.3
v3.18.0
v3.18.0-rc1
v3.18.0-rc2
v3.18.1
v3.19.0
v3.19.0-rc1
v3.19.0-rc2
v3.19.1
v3.19.2
v3.19.3
v3.19.4
v3.20.0
v3.20.0-rc1
v3.20.0-rc3
v3.20.1
v3.20.1-rc1
Database specific
vanir_signatures
[
{
"signature_type": "Line",
"target": {
"file": "src/google/protobuf/compiler/plugin.pb.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"99802369379779068741640024407784092008",
"225304807984448079980401650582696715752",
"252831113805316861556574171429044010978",
"224179326576241034740376008476800918793"
]
},
"source": "https://github.com/protocolbuffers/protobuf/commit/5cba162a5d93f8df786d828621019e03e50edb4f",
"id": "CVE-2022-3171-188035fa",
"signature_version": "v1"
},
{
"signature_type": "Line",
"target": {
"file": "src/google/protobuf/descriptor.pb.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"99802369379779068741640024407784092008",
"225304807984448079980401650582696715752",
"252831113805316861556574171429044010978",
"224179326576241034740376008476800918793"
]
},
"source": "https://github.com/protocolbuffers/protobuf/commit/5cba162a5d93f8df786d828621019e03e50edb4f",
"id": "CVE-2022-3171-1a4951d1",
"signature_version": "v1"
},
{
"signature_type": "Line",
"target": {
"file": "src/google/protobuf/wrappers.pb.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"99802369379779068741640024407784092008",
"225304807984448079980401650582696715752",
"252831113805316861556574171429044010978",
"224179326576241034740376008476800918793"
]
},
"source": "https://github.com/protocolbuffers/protobuf/commit/5cba162a5d93f8df786d828621019e03e50edb4f",
"id": "CVE-2022-3171-2069b3da",
"signature_version": "v1"
},
{
"signature_type": "Line",
"target": {
"file": "src/google/protobuf/any.pb.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"99802369379779068741640024407784092008",
"225304807984448079980401650582696715752",
"252831113805316861556574171429044010978",
"224179326576241034740376008476800918793"
]
},
"source": "https://github.com/protocolbuffers/protobuf/commit/5cba162a5d93f8df786d828621019e03e50edb4f",
"id": "CVE-2022-3171-2f6d50fa",
"signature_version": "v1"
},
{
"signature_type": "Line",
"target": {
"file": "src/google/protobuf/wrappers.pb.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"14463844651962961940331438795809373578",
"214516298593296203942852467115320028386",
"261809066153928994664321823254706116376",
"307626444442344817117879599035219910274"
]
},
"source": "https://github.com/protocolbuffers/protobuf/commit/b8c2488f480bbe3d66b9874c2fcd434201caa48a",
"id": "CVE-2022-3171-3c760779",
"signature_version": "v1"
},
{
"signature_type": "Line",
"target": {
"file": "src/google/protobuf/field_mask.pb.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"99802369379779068741640024407784092008",
"225304807984448079980401650582696715752",
"252831113805316861556574171429044010978",
"224179326576241034740376008476800918793"
]
},
"source": "https://github.com/protocolbuffers/protobuf/commit/5cba162a5d93f8df786d828621019e03e50edb4f",
"id": "CVE-2022-3171-4e70c1e4",
"signature_version": "v1"
},
{
"signature_type": "Line",
"target": {
"file": "src/google/protobuf/descriptor.pb.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"14463844651962961940331438795809373578",
"214516298593296203942852467115320028386",
"261809066153928994664321823254706116376",
"307626444442344817117879599035219910274"
]
},
"source": "https://github.com/protocolbuffers/protobuf/commit/b8c2488f480bbe3d66b9874c2fcd434201caa48a",
"id": "CVE-2022-3171-51960048",
"signature_version": "v1"
},
{
"signature_type": "Line",
"target": {
"file": "src/google/protobuf/timestamp.pb.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"14463844651962961940331438795809373578",
"214516298593296203942852467115320028386",
"261809066153928994664321823254706116376",
"307626444442344817117879599035219910274"
]
},
"source": "https://github.com/protocolbuffers/protobuf/commit/b8c2488f480bbe3d66b9874c2fcd434201caa48a",
"id": "CVE-2022-3171-610f4e97",
"signature_version": "v1"
},
{
"signature_type": "Line",
"target": {
"file": "src/google/protobuf/api.pb.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"14463844651962961940331438795809373578",
"214516298593296203942852467115320028386",
"261809066153928994664321823254706116376",
"307626444442344817117879599035219910274"
]
},
"source": "https://github.com/protocolbuffers/protobuf/commit/b8c2488f480bbe3d66b9874c2fcd434201caa48a",
"id": "CVE-2022-3171-6bc36508",
"signature_version": "v1"
},
{
"signature_type": "Line",
"target": {
"file": "src/google/protobuf/compiler/plugin.pb.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"14463844651962961940331438795809373578",
"214516298593296203942852467115320028386",
"261809066153928994664321823254706116376",
"307626444442344817117879599035219910274"
]
},
"source": "https://github.com/protocolbuffers/protobuf/commit/b8c2488f480bbe3d66b9874c2fcd434201caa48a",
"id": "CVE-2022-3171-7b523458",
"signature_version": "v1"
},
{
"signature_type": "Line",
"target": {
"file": "src/google/protobuf/timestamp.pb.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"99802369379779068741640024407784092008",
"225304807984448079980401650582696715752",
"252831113805316861556574171429044010978",
"224179326576241034740376008476800918793"
]
},
"source": "https://github.com/protocolbuffers/protobuf/commit/5cba162a5d93f8df786d828621019e03e50edb4f",
"id": "CVE-2022-3171-7b59bb12",
"signature_version": "v1"
},
{
"signature_type": "Line",
"target": {
"file": "src/google/protobuf/type.pb.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"14463844651962961940331438795809373578",
"214516298593296203942852467115320028386",
"261809066153928994664321823254706116376",
"307626444442344817117879599035219910274"
]
},
"source": "https://github.com/protocolbuffers/protobuf/commit/b8c2488f480bbe3d66b9874c2fcd434201caa48a",
"id": "CVE-2022-3171-892436e4",
"signature_version": "v1"
},
{
"signature_type": "Line",
"target": {
"file": "src/google/protobuf/any.pb.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"14463844651962961940331438795809373578",
"214516298593296203942852467115320028386",
"261809066153928994664321823254706116376",
"307626444442344817117879599035219910274"
]
},
"source": "https://github.com/protocolbuffers/protobuf/commit/b8c2488f480bbe3d66b9874c2fcd434201caa48a",
"id": "CVE-2022-3171-8c2e0192",
"signature_version": "v1"
},
{
"signature_type": "Line",
"target": {
"file": "src/google/protobuf/api.pb.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"99802369379779068741640024407784092008",
"225304807984448079980401650582696715752",
"252831113805316861556574171429044010978",
"224179326576241034740376008476800918793"
]
},
"source": "https://github.com/protocolbuffers/protobuf/commit/5cba162a5d93f8df786d828621019e03e50edb4f",
"id": "CVE-2022-3171-8ec1c149",
"signature_version": "v1"
},
{
"signature_type": "Line",
"target": {
"file": "src/google/protobuf/empty.pb.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"99802369379779068741640024407784092008",
"225304807984448079980401650582696715752",
"252831113805316861556574171429044010978",
"224179326576241034740376008476800918793"
]
},
"source": "https://github.com/protocolbuffers/protobuf/commit/5cba162a5d93f8df786d828621019e03e50edb4f",
"id": "CVE-2022-3171-97dee356",
"signature_version": "v1"
},
{
"signature_type": "Line",
"target": {
"file": "src/google/protobuf/type.pb.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"99802369379779068741640024407784092008",
"225304807984448079980401650582696715752",
"252831113805316861556574171429044010978",
"224179326576241034740376008476800918793"
]
},
"source": "https://github.com/protocolbuffers/protobuf/commit/5cba162a5d93f8df786d828621019e03e50edb4f",
"id": "CVE-2022-3171-9c5325d9",
"signature_version": "v1"
},
{
"signature_type": "Line",
"target": {
"file": "src/google/protobuf/empty.pb.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"14463844651962961940331438795809373578",
"214516298593296203942852467115320028386",
"261809066153928994664321823254706116376",
"307626444442344817117879599035219910274"
]
},
"source": "https://github.com/protocolbuffers/protobuf/commit/b8c2488f480bbe3d66b9874c2fcd434201caa48a",
"id": "CVE-2022-3171-b0f21209",
"signature_version": "v1"
},
{
"signature_type": "Line",
"target": {
"file": "src/google/protobuf/duration.pb.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"14463844651962961940331438795809373578",
"214516298593296203942852467115320028386",
"261809066153928994664321823254706116376",
"307626444442344817117879599035219910274"
]
},
"source": "https://github.com/protocolbuffers/protobuf/commit/b8c2488f480bbe3d66b9874c2fcd434201caa48a",
"id": "CVE-2022-3171-c1227f64",
"signature_version": "v1"
},
{
"signature_type": "Line",
"target": {
"file": "src/google/protobuf/duration.pb.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"99802369379779068741640024407784092008",
"225304807984448079980401650582696715752",
"252831113805316861556574171429044010978",
"224179326576241034740376008476800918793"
]
},
"source": "https://github.com/protocolbuffers/protobuf/commit/5cba162a5d93f8df786d828621019e03e50edb4f",
"id": "CVE-2022-3171-c9c7f1ec",
"signature_version": "v1"
},
{
"signature_type": "Line",
"target": {
"file": "src/google/protobuf/field_mask.pb.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"14463844651962961940331438795809373578",
"214516298593296203942852467115320028386",
"261809066153928994664321823254706116376",
"307626444442344817117879599035219910274"
]
},
"source": "https://github.com/protocolbuffers/protobuf/commit/b8c2488f480bbe3d66b9874c2fcd434201caa48a",
"id": "CVE-2022-3171-d5e132eb",
"signature_version": "v1"
},
{
"signature_type": "Line",
"target": {
"file": "src/google/protobuf/source_context.pb.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"14463844651962961940331438795809373578",
"214516298593296203942852467115320028386",
"261809066153928994664321823254706116376",
"307626444442344817117879599035219910274"
]
},
"source": "https://github.com/protocolbuffers/protobuf/commit/b8c2488f480bbe3d66b9874c2fcd434201caa48a",
"id": "CVE-2022-3171-ebeb0e90",
"signature_version": "v1"
},
{
"signature_type": "Line",
"target": {
"file": "src/google/protobuf/struct.pb.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"99802369379779068741640024407784092008",
"225304807984448079980401650582696715752",
"252831113805316861556574171429044010978",
"224179326576241034740376008476800918793"
]
},
"source": "https://github.com/protocolbuffers/protobuf/commit/5cba162a5d93f8df786d828621019e03e50edb4f",
"id": "CVE-2022-3171-f9310ee7",
"signature_version": "v1"
},
{
"signature_type": "Line",
"target": {
"file": "src/google/protobuf/source_context.pb.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"99802369379779068741640024407784092008",
"225304807984448079980401650582696715752",
"252831113805316861556574171429044010978",
"224179326576241034740376008476800918793"
]
},
"source": "https://github.com/protocolbuffers/protobuf/commit/5cba162a5d93f8df786d828621019e03e50edb4f",
"id": "CVE-2022-3171-f931a154",
"signature_version": "v1"
},
{
"signature_type": "Line",
"target": {
"file": "src/google/protobuf/struct.pb.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"14463844651962961940331438795809373578",
"214516298593296203942852467115320028386",
"261809066153928994664321823254706116376",
"307626444442344817117879599035219910274"
]
},
"source": "https://github.com/protocolbuffers/protobuf/commit/b8c2488f480bbe3d66b9874c2fcd434201caa48a",
"id": "CVE-2022-3171-fd9bc12e",
"signature_version": "v1"
}
]
source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-3171.json"