Skip to content
OpenAdvisories
High · 7.5 Public exploit CVE-2022-3509 EUVD-2022-7625GHSA-g5ww-5jh7-63cx

Parsing issue in protobuf textformat

Published Nov 1, 2022 · Updated Apr 22, 2025 · Assigned by Google

Vendor: Google Product: Protocolbuffers Package: celeborn-0.6 Package: com.google.protobuf:protobuf-java Package: com.google.protobuf:protobuf-javalite Package: protobuf Package: protobuf Package: trino Package: trino-config Package: trino-oci-entrypoint Package: trino-plugin-ai-functions Package: trino-plugin-bigquery Package: trino-plugin-blackhole Package: trino-plugin-cassandra Package: trino-plugin-clickhouse Package: trino-plugin-delta-lake Package: trino-plugin-druid Package: trino-plugin-duckdb Package: trino-plugin-elasticsearch Package: trino-plugin-exasol Package: trino-plugin-exchange-filesystem Package: trino-plugin-exchange-hdfs Package: trino-plugin-faker Package: trino-plugin-functions-python Package: trino-plugin-geospatial Package: trino-plugin-google-sheets Package: trino-plugin-hive Package: trino-plugin-http-event-listener Package: trino-plugin-http-server-event-listener Package: trino-plugin-hudi Package: trino-plugin-iceberg Package: trino-plugin-ignite Package: trino-plugin-jmx Package: trino-plugin-kafka Package: trino-plugin-kafka-event-listener Package: trino-plugin-lakehouse Package: trino-plugin-ldap-group-provider Package: trino-plugin-loki Package: trino-plugin-mariadb Package: trino-plugin-memory Package: trino-plugin-ml Package: trino-plugin-mongodb Package: trino-plugin-mysql Package: trino-plugin-mysql-event-listener Package: trino-plugin-opa Package: trino-plugin-openlineage Package: trino-plugin-opensearch Package: trino-plugin-oracle Package: trino-plugin-password-authenticators Package: trino-plugin-pinot Package: trino-plugin-postgresql Package: trino-plugin-prometheus Package: trino-plugin-ranger Package: trino-plugin-redis Package: trino-plugin-redshift Package: trino-plugin-resource-group-managers Package: trino-plugin-session-property-managers Package: trino-plugin-singlestore Package: trino-plugin-snowflake Package: trino-plugin-spooling-filesystem Package: trino-plugin-sqlserver Package: trino-plugin-teradata-functions Package: trino-plugin-thrift Package: trino-plugin-tpcds Package: trino-plugin-tpch Package: trino-plugin-vertica Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu Ecosystem: Wolfi

Description

A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.

Affected products

VendorProductAffectedFixed
Google ProtocolBuffers 3.21.0 – < 3.21.7, 3.20.0 – < 3.20.3, 3.19.0 – < 3.19.6, 3.16.0 – < 3.16.3 3.21.7

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 protobuf 3.21.9-3 —
Debian 13 protobuf 3.21.9-3 —
Debian 12 protobuf 3.21.9-3 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu Pro 16.04 LTS protobuf No fix yet —
Ubuntu Pro 14.04 LTS protobuf No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling celeborn-0.6 0.6.3-r7 —
Wolfi rolling trino +58 439-r0 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven com.google.protobuf:protobuf-java >= 3.0.0, < 3.16.3 3.16.3 GHSA-g5ww-5jh7-63cx
Maven com.google.protobuf:protobuf-java >= 3.17.0, < 3.19.6 3.19.6 GHSA-g5ww-5jh7-63cx
Maven com.google.protobuf:protobuf-java >= 3.20.0, < 3.20.3 3.20.3 GHSA-g5ww-5jh7-63cx
Maven com.google.protobuf:protobuf-java >= 3.21.0, < 3.21.7 3.21.7 GHSA-g5ww-5jh7-63cx
Maven com.google.protobuf:protobuf-javalite >= 3.20.0, < 3.20.3 3.20.3 GHSA-g5ww-5jh7-63cx
Maven com.google.protobuf:protobuf-javalite >= 3.21.0, < 3.21.7 3.21.7 GHSA-g5ww-5jh7-63cx
Maven com.google.protobuf:protobuf-javalite >= 3.0.0, < 3.16.3 3.16.3 GHSA-g5ww-5jh7-63cx

Advisories 8

References