CVE-2022-3171

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-3171
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-3171.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-3171
Aliases
Downstream
Related
Published
2022-10-12T23:15:09.807Z
Modified
2026-04-11T12:40:13.033781Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "CPE_FIELD",
            "cpe": "cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*",
            "extracted_events": [
                {
                    "last_affected": "37"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/protocolbuffers/protobuf

Affected ranges

Type
GIT
Repo
https://github.com/protocolbuffers/protobuf
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b8c2488f480bbe3d66b9874c2fcd434201caa48a
Introduced
652d99a8ee8aa6b801e11977951fbf444cfccc8f
Fixed
5cba162a5d93f8df786d828621019e03e50edb4f
Introduced
bc799d78f81115940eec953e2937245c70e3e6e4
Fixed
fe271ab76f2ad2b2b28c10443865d2af21e27e0e
Introduced
7062d0a2d0075d5e7d5c294fd3984df67a976da3
Fixed
54489e95e01882407f356f83c9074415e561db00
Database specific 
{
    "source": "CPE_FIELD",
    "cpe": [
        "cpe:2.3:a:google:google-protobuf:*:*:*:*:*:ruby:*:*",
        "cpe:2.3:a:google:protobuf-java:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:google:protobuf-javalite:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:google:protobuf-kotlin:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:google:protobuf-kotlin-lite:*:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.16.3"
        },
        {
            "introduced": "3.17.0"
        },
        {
            "fixed": "3.19.6"
        },
        {
            "introduced": "3.20.0"
        },
        {
            "fixed": "3.20.3"
        },
        {
            "introduced": "3.21.0"
        },
        {
            "fixed": "3.21.7"
        }
    ]
}

Affected versions

v2.*
v2.6.0
v2.6.1rc1
v21.*
v21.0-rc1
v21.0-rc2
v3.*
v3.0.0-alpha-3
v3.0.0-alpha-4
v3.0.0-beta-1
v3.0.0-beta-1-bzl-fix
v3.0.0-beta-2
v3.0.0-beta-3-pre-1
v3.12.3
v3.16.0
v3.16.0-rc1
v3.16.0-rc2
v3.16.1
v3.19.0
v3.19.0-rc1
v3.19.0-rc2
v3.19.1
v3.19.2
v3.19.3
v3.19.4
v3.20.0
v3.20.0-rc2
v3.20.0-rc3
v3.20.1
v3.20.1-rc1

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-3171.json"