{"schema_version":"1.7.5","id":"GHSA-h4h5-3hr4-j3g2","published":"2022-10-04T22:17:15Z","modified":"2026-07-08T06:27:17.898648580Z","aliases":["CVE-2022-3171"],"related":["CGA-8f53-f8wm-95fh"],"summary":"protobuf-java has a potential Denial of Service issue","details":"## Summary\nA potential Denial of Service issue in `protobuf-java` core and lite was discovered in the parsing procedure for binary and text format data. Input streams containing multiple instances of non-repeated [embedded messages](http://developers.google.com/protocol-buffers/docs/encoding#embedded) with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. \n\nReporter: [OSS Fuzz](https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48771)\n\nAffected versions: This issue affects both the Java full and lite Protobuf runtimes, as well as Protobuf for Kotlin and JRuby, which themselves use the Java Protobuf runtime.\n\n## Severity\n\n[CVE-2022-3171](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3171) Medium - CVSS Score: 5.7 (NOTE: there may be a delay in publication)\n\n## Remediation and Mitigation\n\nPlease update to the latest available versions of the following packages:\n\nprotobuf-java (3.21.7, 3.20.3, 3.19.6, 3.16.3)\nprotobuf-javalite (3.21.7, 3.20.3, 3.19.6, 3.16.3)\nprotobuf-kotlin (3.21.7, 3.20.3, 3.19.6, 3.16.3)\nprotobuf-kotlin-lite (3.21.7, 3.20.3, 3.19.6, 3.16.3)\ngoogle-protobuf [JRuby gem only] (3.21.7, 3.20.3, 3.19.6)\n","affected":[{"package":{"name":"com.google.protobuf:protobuf-java","ecosystem":"Maven","purl":"pkg:maven/com.google.protobuf/protobuf-java"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.21.0-rc-1"},{"fixed":"3.21.7"}]}],"versions":["3.21.0","3.21.0-rc-1","3.21.0-rc-2","3.21.1","3.21.2","3.21.3","3.21.4","3.21.5","3.21.6"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-h4h5-3hr4-j3g2/GHSA-h4h5-3hr4-j3g2.json"}},{"package":{"name":"com.google.protobuf:protobuf-kotlin","ecosystem":"Maven","purl":"pkg:maven/com.google.protobuf/protobuf-kotlin"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.21.0-rc-1"},{"fixed":"3.21.7"}]}],"versions":["3.21.0","3.21.0-rc-1","3.21.0-rc-2","3.21.1","3.21.2","3.21.3","3.21.4","3.21.5","3.21.6"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-h4h5-3hr4-j3g2/GHSA-h4h5-3hr4-j3g2.json"}},{"package":{"name":"google-protobuf","ecosystem":"RubyGems","purl":"pkg:gem/google-protobuf"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.21.0.rc.1"},{"fixed":"3.21.7"}]}],"versions":["3.21.0","3.21.0.rc.1","3.21.0.rc.2","3.21.1","3.21.2","3.21.3","3.21.4","3.21.5","3.21.6"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-h4h5-3hr4-j3g2/GHSA-h4h5-3hr4-j3g2.json"}},{"package":{"name":"com.google.protobuf:protobuf-javalite","ecosystem":"Maven","purl":"pkg:maven/com.google.protobuf/protobuf-javalite"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.21.0-rc-1"},{"fixed":"3.21.7"}]}],"versions":["3.21.0","3.21.0-rc-1","3.21.0-rc-2","3.21.1","3.21.2","3.21.3","3.21.4","3.21.5","3.21.6"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-h4h5-3hr4-j3g2/GHSA-h4h5-3hr4-j3g2.json"}},{"package":{"name":"com.google.protobuf:protobuf-kotlin-lite","ecosystem":"Maven","purl":"pkg:maven/com.google.protobuf/protobuf-kotlin-lite"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.21.0-rc-1"},{"fixed":"3.21.7"}]}],"versions":["3.21.0","3.21.0-rc-1","3.21.0-rc-2","3.21.1","3.21.2","3.21.3","3.21.4","3.21.5","3.21.6"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-h4h5-3hr4-j3g2/GHSA-h4h5-3hr4-j3g2.json"}},{"package":{"name":"com.google.protobuf:protobuf-java","ecosystem":"Maven","purl":"pkg:maven/com.google.protobuf/protobuf-java"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.20.0-rc-1"},{"fixed":"3.20.3"}]}],"versions":["3.20.0","3.20.0-rc-1","3.20.1","3.20.1-rc-1","3.20.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-h4h5-3hr4-j3g2/GHSA-h4h5-3hr4-j3g2.json"}},{"package":{"name":"com.google.protobuf:protobuf-java","ecosystem":"Maven","purl":"pkg:maven/com.google.protobuf/protobuf-java"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.17.0-rc-1"},{"fixed":"3.19.6"}]}],"versions":["3.17.0","3.17.0-rc-1","3.17.0-rc-2","3.17.1","3.17.2","3.17.3","3.18.0","3.18.0-rc-1","3.18.0-rc-2","3.18.1","3.18.2","3.18.3","3.19.0","3.19.0-rc-1","3.19.0-rc-2","3.19.1","3.19.2","3.19.3","3.19.4","3.19.5"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-h4h5-3hr4-j3g2/GHSA-h4h5-3hr4-j3g2.json"}},{"package":{"name":"com.google.protobuf:protobuf-java","ecosystem":"Maven","purl":"pkg:maven/com.google.protobuf/protobuf-java"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.3"}]}],"versions":["2.0.1","2.0.3","2.1.0","2.2.0","2.3.0","2.4.0a","2.4.1","2.5.0","2.6.0","2.6.1","3.0.0","3.0.0-alpha-2","3.0.0-alpha-3","3.0.0-alpha-3.1","3.0.0-beta-1","3.0.0-beta-2","3.0.0-beta-3","3.0.0-beta-4","3.0.2","3.1.0","3.10.0","3.10.0-rc-1","3.11.0","3.11.0-rc-1","3.11.0-rc-2","3.11.1","3.11.3","3.11.4","3.12.0","3.12.0-rc-1","3.12.0-rc-2","3.12.1","3.12.2","3.12.4","3.13.0","3.13.0-rc-3","3.14.0","3.14.0-rc-1","3.14.0-rc-2","3.14.0-rc-3","3.15.0","3.15.0-rc-1","3.15.0-rc-2","3.15.1","3.15.2","3.15.3","3.15.4","3.15.5","3.15.6","3.15.7","3.15.8","3.16.0","3.16.0-rc-1","3.16.0-rc-2","3.16.1","3.2.0","3.2.0-rc.1","3.2.0rc2","3.3.0","3.3.1","3.4.0","3.5.0","3.5.1","3.6.0","3.6.1","3.7.0","3.7.0-rc1","3.7.1","3.8.0","3.8.0-rc-1","3.9.0","3.9.0-rc-1","3.9.1","3.9.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-h4h5-3hr4-j3g2/GHSA-h4h5-3hr4-j3g2.json"}},{"package":{"name":"com.google.protobuf:protobuf-kotlin","ecosystem":"Maven","purl":"pkg:maven/com.google.protobuf/protobuf-kotlin"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.20.0-rc-1"},{"fixed":"3.20.3"}]}],"versions":["3.20.0","3.20.0-rc-1","3.20.1","3.20.1-rc-1","3.20.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-h4h5-3hr4-j3g2/GHSA-h4h5-3hr4-j3g2.json"}},{"package":{"name":"com.google.protobuf:protobuf-kotlin","ecosystem":"Maven","purl":"pkg:maven/com.google.protobuf/protobuf-kotlin"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.17.0-rc-1"},{"fixed":"3.19.6"}]}],"versions":["3.17.0","3.17.0-rc-2","3.17.1","3.17.2","3.17.3","3.18.0","3.18.0-rc-1","3.18.0-rc-2","3.18.1","3.18.2","3.18.3","3.19.0","3.19.0-rc-1","3.19.0-rc-2","3.19.1","3.19.2","3.19.3","3.19.4","3.19.5"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-h4h5-3hr4-j3g2/GHSA-h4h5-3hr4-j3g2.json"}},{"package":{"name":"com.google.protobuf:protobuf-kotlin","ecosystem":"Maven","purl":"pkg:maven/com.google.protobuf/protobuf-kotlin"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.3"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-h4h5-3hr4-j3g2/GHSA-h4h5-3hr4-j3g2.json"}},{"package":{"name":"google-protobuf","ecosystem":"RubyGems","purl":"pkg:gem/google-protobuf"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.20.0.rc.1"},{"fixed":"3.20.3"}]}],"versions":["3.20.0","3.20.0.rc.1","3.20.0.rc.2","3.20.1","3.20.1.rc.1","3.20.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-h4h5-3hr4-j3g2/GHSA-h4h5-3hr4-j3g2.json"}},{"package":{"name":"google-protobuf","ecosystem":"RubyGems","purl":"pkg:gem/google-protobuf"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.17.0.rc.1"},{"fixed":"3.19.6"}]}],"versions":["3.17.0","3.17.0.rc.1","3.17.0.rc.2","3.17.1","3.17.2","3.17.3","3.18.0","3.18.0.rc.1","3.18.0.rc.2","3.18.1","3.18.2","3.18.3","3.19.0","3.19.0.rc.1","3.19.0.rc.2","3.19.1","3.19.2","3.19.3","3.19.4","3.19.5"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-h4h5-3hr4-j3g2/GHSA-h4h5-3hr4-j3g2.json"}},{"package":{"name":"google-protobuf","ecosystem":"RubyGems","purl":"pkg:gem/google-protobuf"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.3"}]}],"versions":["3.0.0","3.0.0.alpha.1.0","3.0.0.alpha.1.1","3.0.0.alpha.2.0","3.0.0.alpha.3","3.0.0.alpha.3.1.pre","3.0.0.alpha.4.0","3.0.0.alpha.5.0.3","3.0.0.alpha.5.0.4","3.0.0.alpha.5.0.5","3.0.0.alpha.5.0.5.1","3.0.2","3.1.0","3.1.0.0.pre","3.10.0.rc.1","3.10.1","3.11.0","3.11.0.rc.1","3.11.0.rc.2","3.11.1","3.11.2","3.11.3","3.11.4","3.12.0","3.12.0.rc.1","3.12.0.rc.2","3.12.1","3.12.2","3.12.4","3.13.0","3.13.0.rc.3","3.14.0","3.14.0.rc.1","3.14.0.rc.2","3.14.0.rc.3","3.15.0","3.15.0.rc.1","3.15.0.rc.2","3.15.1","3.15.2","3.15.3","3.15.4","3.15.5","3.15.6","3.15.7","3.15.8","3.16.0","3.16.0.rc.1","3.16.0.rc.2","3.2.0","3.2.0.1","3.2.0.2","3.2.1.pre","3.3.0","3.4.0.1","3.4.0.2","3.4.1.1","3.5.0","3.5.0.pre","3.5.1","3.5.1.1","3.5.1.2","3.6.0","3.6.1","3.7.0","3.7.0.rc.2","3.7.0.rc.3","3.7.1","3.8.0","3.8.0.rc.1","3.9.0","3.9.0.rc.1","3.9.1","3.9.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-h4h5-3hr4-j3g2/GHSA-h4h5-3hr4-j3g2.json"}},{"package":{"name":"com.google.protobuf:protobuf-javalite","ecosystem":"Maven","purl":"pkg:maven/com.google.protobuf/protobuf-javalite"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.20.0-rc-1"},{"fixed":"3.20.3"}]}],"versions":["3.20.0","3.20.0-rc-1","3.20.1","3.20.1-rc-1","3.20.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-h4h5-3hr4-j3g2/GHSA-h4h5-3hr4-j3g2.json"}},{"package":{"name":"com.google.protobuf:protobuf-javalite","ecosystem":"Maven","purl":"pkg:maven/com.google.protobuf/protobuf-javalite"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.17.0-rc-1"},{"fixed":"3.19.6"}]}],"versions":["3.17.0","3.17.0-rc-1","3.17.0-rc-2","3.17.1","3.17.2","3.17.3","3.18.0","3.18.0-rc-1","3.18.0-rc-2","3.18.1","3.18.2","3.18.3","3.19.0","3.19.0-rc-1","3.19.0-rc-2","3.19.1","3.19.2","3.19.3","3.19.4","3.19.5"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-h4h5-3hr4-j3g2/GHSA-h4h5-3hr4-j3g2.json"}},{"package":{"name":"com.google.protobuf:protobuf-javalite","ecosystem":"Maven","purl":"pkg:maven/com.google.protobuf/protobuf-javalite"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.3"}]}],"versions":["3.10.0","3.10.0-rc-1","3.11.0","3.11.0-rc-1","3.11.0-rc-2","3.11.1","3.11.3","3.11.4","3.12.0","3.12.0-rc-1","3.12.0-rc-2","3.12.1","3.12.2","3.12.4","3.13.0","3.13.0-rc-3","3.14.0","3.14.0-rc-1","3.14.0-rc-2","3.14.0-rc-3","3.15.0","3.15.0-rc-1","3.15.0-rc-2","3.15.1","3.15.2","3.15.3","3.15.4","3.15.5","3.15.6","3.15.7","3.15.8","3.16.0","3.16.0-rc-1","3.16.0-rc-2","3.16.1","3.8.0","3.8.0-rc-1","3.9.0","3.9.0-rc-1","3.9.1","3.9.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-h4h5-3hr4-j3g2/GHSA-h4h5-3hr4-j3g2.json"}},{"package":{"name":"com.google.protobuf:protobuf-kotlin-lite","ecosystem":"Maven","purl":"pkg:maven/com.google.protobuf/protobuf-kotlin-lite"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.20.0-rc-1"},{"fixed":"3.20.3"}]}],"versions":["3.20.0","3.20.0-rc-1","3.20.1","3.20.1-rc-1","3.20.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-h4h5-3hr4-j3g2/GHSA-h4h5-3hr4-j3g2.json"}},{"package":{"name":"com.google.protobuf:protobuf-kotlin-lite","ecosystem":"Maven","purl":"pkg:maven/com.google.protobuf/protobuf-kotlin-lite"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.17.0-rc-1"},{"fixed":"3.19.6"}]}],"versions":["3.17.0","3.17.0-rc-2","3.17.1","3.17.2","3.17.3","3.18.0","3.18.0-rc-1","3.18.0-rc-2","3.18.1","3.18.2","3.18.3","3.19.0","3.19.0-rc-1","3.19.0-rc-2","3.19.1","3.19.2","3.19.3","3.19.4","3.19.5"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-h4h5-3hr4-j3g2/GHSA-h4h5-3hr4-j3g2.json"}},{"package":{"name":"com.google.protobuf:protobuf-kotlin-lite","ecosystem":"Maven","purl":"pkg:maven/com.google.protobuf/protobuf-kotlin-lite"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.3"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-h4h5-3hr4-j3g2/GHSA-h4h5-3hr4-j3g2.json"}}],"references":[{"type":"WEB","url":"https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-h4h5-3hr4-j3g2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3171"},{"type":"WEB","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48771"},{"type":"PACKAGE","url":"https://github.com/protocolbuffers/protobuf"},{"type":"WEB","url":"https://github.com/protocolbuffers/protobuf/releases/tag/v21.7"},{"type":"WEB","url":"https://github.com/protocolbuffers/protobuf/releases/tag/v3.16.3"},{"type":"WEB","url":"https://github.com/protocolbuffers/protobuf/releases/tag/v3.19.6"},{"type":"WEB","url":"https://github.com/protocolbuffers/protobuf/releases/tag/v3.20.3"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/google-protobuf/CVE-2022-3171.yml"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CBAUKJQL6O4TIWYBENORSY5P43TVB4M3"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MPCGUT3T5L6C3IDWUPSUO22QDCGQKTOP"},{"type":"WEB","url":"https://security.gentoo.org/glsa/202301-09"}],"database_specific":{"cwe_ids":["CWE-20"],"github_reviewed":true,"github_reviewed_at":"2022-10-04T22:17:15Z","nvd_published_at":"2022-10-12T23:15:00Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}