CVE-2022-33070

MEDIUM

protobuf-c 1.4.0 - Denial of Service via Invalid Arithmetic Shift in parse_tag_and_wiretype

Title source: llm

Description

Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function parse_tag_and_wiretype in protobuf-c/protobuf-c.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via unspecified vectors.

References (3)

Core 3

Core References

Exploit, Issue Tracking, Patch, Third Party Advisory x_refsource_misc

https://github.com/protobuf-c/protobuf-c/issues/506

Exploit, Issue Tracking, Patch, Third Party Advisory x_refsource_misc

https://github.com/protobuf-c/protobuf-c/pull/508

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FFN2GHUEGTSHRD7J5PKQ5DRSJSEQ2IKN/

Scores

CVSS v3 5.5

EPSS 0.0009

EPSS Percentile 25.4%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Details

Status published

Products (2)

fedoraproject/fedora 36

protobuf-c_project/protobuf-c 1.4.0

Published Jun 23, 2022

Tracked Since Feb 18, 2026