Read the docs
TI-2022-02927 Aliases CVE-2022-3171GHSA-h4h5-3hr4-j3g2

Memory handling vulnerability in ProtocolBuffers Java core and lite

Priority LOW 35CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01278 70th percentileScored 2026-11-07
Fix Fixed Protocolbuffers (Google LLC): 3.21.7, 3.20.3, 3.19.6 +1com.google.protobuf:protobuf-java (Maven): 3.21.7, 3.20.3, 3.19.6 +1+4 more productsRed Hat: 5 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GoogleProtocolbuffers3.21.7 to before 3.21.7; 3.20.3 to before 3.20.3; 3.19.6 to before 3.19.6; 3.16.3 to before 3.16.33.21.7, 3.20.3, 3.19.6, 3.16.3Patch availableCNA
—com.google.protobuf:protobuf-java (Maven)3.21.0-rc-1 to before 3.21.73.21.7Patch availableGHSA-h4h5-3hr4-j3g2
—com.google.protobuf:protobuf-kotlin (Maven)3.21.0-rc-1 to before 3.21.73.21.7Patch availableGHSA-h4h5-3hr4-j3g2
—google-protobuf (RubyGems)3.21.0.rc.1 to before 3.21.73.21.7Patch availableGHSA-h4h5-3hr4-j3g2
—com.google.protobuf:protobuf-javalite (Maven)3.21.0-rc-1 to before 3.21.73.21.7Patch availableGHSA-h4h5-3hr4-j3g2
—com.google.protobuf:protobuf-kotlin-lite (Maven)3.21.0-rc-1 to before 3.21.73.21.7Patch availableGHSA-h4h5-3hr4-j3g2
—com.google.protobuf:protobuf-java (Maven)3.20.0-rc-1 to before 3.20.33.20.3Patch availableGHSA-h4h5-3hr4-j3g2
—com.google.protobuf:protobuf-java (Maven)3.17.0-rc-1 to before 3.19.63.19.6Patch availableGHSA-h4h5-3hr4-j3g2
—com.google.protobuf:protobuf-java (Maven)before 3.16.33.16.3Patch availableGHSA-h4h5-3hr4-j3g2
—com.google.protobuf:protobuf-kotlin (Maven)3.20.0-rc-1 to before 3.20.33.20.3Patch availableGHSA-h4h5-3hr4-j3g2
—com.google.protobuf:protobuf-kotlin (Maven)3.17.0-rc-1 to before 3.19.63.19.6Patch availableGHSA-h4h5-3hr4-j3g2
—com.google.protobuf:protobuf-kotlin (Maven)before 3.16.33.16.3Patch availableGHSA-h4h5-3hr4-j3g2
—google-protobuf (RubyGems)3.20.0.rc.1 to before 3.20.33.20.3Patch availableGHSA-h4h5-3hr4-j3g2
—google-protobuf (RubyGems)3.17.0.rc.1 to before 3.19.63.19.6Patch availableGHSA-h4h5-3hr4-j3g2
—google-protobuf (RubyGems)before 3.16.33.16.3Patch availableGHSA-h4h5-3hr4-j3g2
—com.google.protobuf:protobuf-javalite (Maven)3.20.0-rc-1 to before 3.20.33.20.3Patch availableGHSA-h4h5-3hr4-j3g2
—com.google.protobuf:protobuf-javalite (Maven)3.17.0-rc-1 to before 3.19.63.19.6Patch availableGHSA-h4h5-3hr4-j3g2
—com.google.protobuf:protobuf-javalite (Maven)before 3.16.33.16.3Patch availableGHSA-h4h5-3hr4-j3g2
—com.google.protobuf:protobuf-kotlin-lite (Maven)3.20.0-rc-1 to before 3.20.33.20.3Patch availableGHSA-h4h5-3hr4-j3g2
—com.google.protobuf:protobuf-kotlin-lite (Maven)3.17.0-rc-1 to before 3.19.63.19.6Patch availableGHSA-h4h5-3hr4-j3g2
—com.google.protobuf:protobuf-kotlin-lite (Maven)before 3.16.33.16.3Patch availableGHSA-h4h5-3hr4-j3g2
  • Protocolbuffers VendorGoogle Affected 3.21.7 to before 3.21.7; 3.20.3 to before 3.20.3; 3.19.6 to before 3.19.6; 3.16.3 to before 3.16.3 Fixed in 3.21.7, 3.20.3, 3.19.6, 3.16.3 Patch available CNA
  • com.google.protobuf:protobuf-java (Maven) Vendor— Affected 3.21.0-rc-1 to before 3.21.7 Fixed in 3.21.7 Patch available GHSA-h4h5-3hr4-j3g2
  • com.google.protobuf:protobuf-kotlin (Maven) Vendor— Affected 3.21.0-rc-1 to before 3.21.7 Fixed in 3.21.7 Patch available GHSA-h4h5-3hr4-j3g2
  • google-protobuf (RubyGems) Vendor— Affected 3.21.0.rc.1 to before 3.21.7 Fixed in 3.21.7 Patch available GHSA-h4h5-3hr4-j3g2
  • com.google.protobuf:protobuf-javalite (Maven) Vendor— Affected 3.21.0-rc-1 to before 3.21.7 Fixed in 3.21.7 Patch available GHSA-h4h5-3hr4-j3g2
  • com.google.protobuf:protobuf-kotlin-lite (Maven) Vendor— Affected 3.21.0-rc-1 to before 3.21.7 Fixed in 3.21.7 Patch available GHSA-h4h5-3hr4-j3g2
  • com.google.protobuf:protobuf-java (Maven) Vendor— Affected 3.20.0-rc-1 to before 3.20.3 Fixed in 3.20.3 Patch available GHSA-h4h5-3hr4-j3g2
  • com.google.protobuf:protobuf-java (Maven) Vendor— Affected 3.17.0-rc-1 to before 3.19.6 Fixed in 3.19.6 Patch available GHSA-h4h5-3hr4-j3g2
  • com.google.protobuf:protobuf-java (Maven) Vendor— Affected before 3.16.3 Fixed in 3.16.3 Patch available GHSA-h4h5-3hr4-j3g2
  • com.google.protobuf:protobuf-kotlin (Maven) Vendor— Affected 3.20.0-rc-1 to before 3.20.3 Fixed in 3.20.3 Patch available GHSA-h4h5-3hr4-j3g2
  • com.google.protobuf:protobuf-kotlin (Maven) Vendor— Affected 3.17.0-rc-1 to before 3.19.6 Fixed in 3.19.6 Patch available GHSA-h4h5-3hr4-j3g2
  • com.google.protobuf:protobuf-kotlin (Maven) Vendor— Affected before 3.16.3 Fixed in 3.16.3 Patch available GHSA-h4h5-3hr4-j3g2
  • google-protobuf (RubyGems) Vendor— Affected 3.20.0.rc.1 to before 3.20.3 Fixed in 3.20.3 Patch available GHSA-h4h5-3hr4-j3g2
  • google-protobuf (RubyGems) Vendor— Affected 3.17.0.rc.1 to before 3.19.6 Fixed in 3.19.6 Patch available GHSA-h4h5-3hr4-j3g2
  • google-protobuf (RubyGems) Vendor— Affected before 3.16.3 Fixed in 3.16.3 Patch available GHSA-h4h5-3hr4-j3g2
  • com.google.protobuf:protobuf-javalite (Maven) Vendor— Affected 3.20.0-rc-1 to before 3.20.3 Fixed in 3.20.3 Patch available GHSA-h4h5-3hr4-j3g2
  • com.google.protobuf:protobuf-javalite (Maven) Vendor— Affected 3.17.0-rc-1 to before 3.19.6 Fixed in 3.19.6 Patch available GHSA-h4h5-3hr4-j3g2
  • com.google.protobuf:protobuf-javalite (Maven) Vendor— Affected before 3.16.3 Fixed in 3.16.3 Patch available GHSA-h4h5-3hr4-j3g2
  • com.google.protobuf:protobuf-kotlin-lite (Maven) Vendor— Affected 3.20.0-rc-1 to before 3.20.3 Fixed in 3.20.3 Patch available GHSA-h4h5-3hr4-j3g2
  • com.google.protobuf:protobuf-kotlin-lite (Maven) Vendor— Affected 3.17.0-rc-1 to before 3.19.6 Fixed in 3.19.6 Patch available GHSA-h4h5-3hr4-j3g2
  • com.google.protobuf:protobuf-kotlin-lite (Maven) Vendor— Affected before 3.16.3 Fixed in 3.16.3 Patch available GHSA-h4h5-3hr4-j3g2

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:google:google-protobuf:*:*:*:*:*:ruby:*:*before 3.16.3; 3.17.0 to before 3.19.6; 3.20.0 to before 3.20.3; 3.21.0 to before 3.21.7VulnerableGoogle
cpe:2.3:a:google:protobuf-java:*:*:*:*:*:*:*:*before 3.16.3; 3.17.0 to before 3.19.6; 3.20.0 to before 3.20.3; 3.21.0 to before 3.21.7VulnerableGoogle
cpe:2.3:a:google:protobuf-javalite:*:*:*:*:*:*:*:*before 3.16.3; 3.17.0 to before 3.19.6; 3.20.0 to before 3.20.3; 3.21.0 to before 3.21.7VulnerableGoogle
cpe:2.3:a:google:protobuf-kotlin:*:*:*:*:*:*:*:*before 3.16.3; 3.17.0 to before 3.19.6; 3.20.0 to before 3.20.3; 3.21.0 to before 3.21.7VulnerableGoogle
cpe:2.3:a:google:protobuf-kotlin-lite:*:*:*:*:*:*:*:*before 3.16.3; 3.17.0 to before 3.19.6; 3.20.0 to before 3.20.3; 3.21.0 to before 3.21.7VulnerableGoogle
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*37VulnerableFedoraproject
  • cpe:2.3:a:google:google-protobuf:*:*:*:*:*:ruby:*:* Versions before 3.16.3; 3.17.0 to before 3.19.6; 3.20.0 to before 3.20.3; 3.21.0 to before 3.21.7 Vulnerable ·Google
  • cpe:2.3:a:google:protobuf-java:*:*:*:*:*:*:*:* Versions before 3.16.3; 3.17.0 to before 3.19.6; 3.20.0 to before 3.20.3; 3.21.0 to before 3.21.7 Vulnerable ·Google
  • cpe:2.3:a:google:protobuf-javalite:*:*:*:*:*:*:*:* Versions before 3.16.3; 3.17.0 to before 3.19.6; 3.20.0 to before 3.20.3; 3.21.0 to before 3.21.7 Vulnerable ·Google
  • cpe:2.3:a:google:protobuf-kotlin:*:*:*:*:*:*:*:* Versions before 3.16.3; 3.17.0 to before 3.19.6; 3.20.0 to before 3.20.3; 3.21.0 to before 3.21.7 Vulnerable ·Google
  • cpe:2.3:a:google:protobuf-kotlin-lite:*:*:*:*:*:*:*:* Versions before 3.16.3; 3.17.0 to before 3.19.6; 3.20.0 to before 3.20.3; 3.21.0 to before 3.21.7 Vulnerable ·Google
  • cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject

Remediation

  • Fix · CNA Protocolbuffers (Google LLC) Fixed in 3.21.7, 3.20.3, 3.19.6, 3.16.3
  • Fix · GHSA-h4h5-3hr4-j3g2 com.google.protobuf:protobuf-java (Maven) Fixed in 3.21.7 Advisory →
  • Fix · GHSA-h4h5-3hr4-j3g2 com.google.protobuf:protobuf-kotlin (Maven) Fixed in 3.21.7 Advisory →
  • Fix · GHSA-h4h5-3hr4-j3g2 google-protobuf (RubyGems) Fixed in 3.21.7 Advisory →
  • Fix · GHSA-h4h5-3hr4-j3g2 com.google.protobuf:protobuf-javalite (Maven) Fixed in 3.21.7 Advisory →
  • Fix · GHSA-h4h5-3hr4-j3g2 com.google.protobuf:protobuf-kotlin-lite (Maven) Fixed in 3.21.7 Advisory →
  • Fix · GHSA-h4h5-3hr4-j3g2 com.google.protobuf:protobuf-java (Maven) Fixed in 3.20.3 Advisory →
  • Fix · GHSA-h4h5-3hr4-j3g2 com.google.protobuf:protobuf-java (Maven) Fixed in 3.19.6 Advisory →
  • Fix · GHSA-h4h5-3hr4-j3g2 com.google.protobuf:protobuf-java (Maven) Fixed in 3.16.3 Advisory →
  • Fix · GHSA-h4h5-3hr4-j3g2 com.google.protobuf:protobuf-kotlin (Maven) Fixed in 3.20.3 Advisory →
  • Fix · GHSA-h4h5-3hr4-j3g2 com.google.protobuf:protobuf-kotlin (Maven) Fixed in 3.19.6 Advisory →
  • Fix · GHSA-h4h5-3hr4-j3g2 com.google.protobuf:protobuf-kotlin (Maven) Fixed in 3.16.3 Advisory →
  • Fix · GHSA-h4h5-3hr4-j3g2 google-protobuf (RubyGems) Fixed in 3.20.3 Advisory →
  • Fix · GHSA-h4h5-3hr4-j3g2 google-protobuf (RubyGems) Fixed in 3.19.6 Advisory →
  • Fix · GHSA-h4h5-3hr4-j3g2 google-protobuf (RubyGems) Fixed in 3.16.3 Advisory →
  • Fix · GHSA-h4h5-3hr4-j3g2 com.google.protobuf:protobuf-javalite (Maven) Fixed in 3.20.3 Advisory →
  • Fix · GHSA-h4h5-3hr4-j3g2 com.google.protobuf:protobuf-javalite (Maven) Fixed in 3.19.6 Advisory →
  • Fix · GHSA-h4h5-3hr4-j3g2 com.google.protobuf:protobuf-javalite (Maven) Fixed in 3.16.3 Advisory →
  • Fix · GHSA-h4h5-3hr4-j3g2 com.google.protobuf:protobuf-kotlin-lite (Maven) Fixed in 3.20.3 Advisory →
  • Fix · GHSA-h4h5-3hr4-j3g2 com.google.protobuf:protobuf-kotlin-lite (Maven) Fixed in 3.19.6 Advisory →
  • Fix · GHSA-h4h5-3hr4-j3g2 com.google.protobuf:protobuf-kotlin-lite (Maven) Fixed in 3.16.3 Advisory →

Red Hat 5 advisories

  • RHSA-2024:3527 Released 2024-05-30 · Red Hat rating Moderate
    Red Hat AMQ Streams 2.7.0 release and security update
    • Red Hat AMQ Streams 2.7.0
  • RHSA-2023:4983 Released 2023-09-05 · Red Hat rating Important
    Red Hat Process Automation Manager 7.13.4 security update
    • RHPAM 7.13.4 async
  • RHSA-2023:1006 Released 2023-03-08 · Red Hat rating Important
    Red Hat build of Quarkus 2.7.7 release and security update
    • Red Hat build of Quarkus 2.7.7
Show 2 more Red Hat advisories
  • RHSA-2022:9023 Released 2022-12-14 · Red Hat rating Important
    Red Hat build of Quarkus 2.13.5 release and security update
    • Red Hat build of Quarkus 2.13.5
  • RHSA-2022:7896 Released 2022-11-09 · Red Hat rating Moderate
    Red Hat Integration Debezium 1.9.7 security update
    • RHINT Debezium 1.9.7

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
RHINT Debezium 1.9.7Fixed RHSA-2022:7896
RHPAM 7.13.4 asyncFixed RHSA-2023:4983
Red Hat AMQ Streams 2.7.0Fixed RHSA-2024:3527
Red Hat build of Quarkus 2.13.5Fixed RHSA-2022:9023
Red Hat build of Quarkus 2.7.7Fixed RHSA-2023:1006

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-3171
  2. 2026-10-03 Alias added: GHSA-h4h5-3hr4-j3g2

References

Advisory 5

Other 9

  • TI-2021-05523 Denial of Service of protobuf-java parsing procedure CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences