CVE-2021-22569

HIGH

protobuf-java < 3.16.1 - Denial of Service via UnknownFieldSet Field Interleaving

Title source: llm
STIX 2.1

Description

An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated pauses. We recommend upgrading libraries beyond the vulnerable versions.

References (6)

Core 6
Core References
Mailing List, Third Party Advisory mailing-list
http://www.openwall.com/lists/oss-security/2022/01/12/4
Mailing List, Third Party Advisory mailing-list
http://www.openwall.com/lists/oss-security/2022/01/12/7
Exploit, Issue Tracking, Mailing List, Vendor Advisory
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39330

Scores

CVSS v3 7.5
EPSS 0.0030
EPSS Percentile 53.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-696
Status published
Products (12)
com.google.protobuf/protobuf-java 0 - 3.16.1Maven
com.google.protobuf/protobuf-kotlin 3.18.0 - 3.18.2Maven
google/google-protobuf < 3.19.2
google/protobuf-java < 3.16.1
google/protobuf-kotlin < 3.18.2
oracle/communications_cloud_native_core_console 1.9.0
oracle/communications_cloud_native_core_network_repository_function 1.15.0
oracle/communications_cloud_native_core_network_repository_function 1.15.1
oracle/communications_cloud_native_core_policy 1.15.0
oracle/spatial_and_graph_mapviewer 19c
... and 2 more
Published Jan 10, 2022
Tracked Since Feb 18, 2026