Skip to content
OpenAdvisories
High · 7.5 CVE-2022-3510 EUVD-2022-7503GHSA-4gg5-vx3j-xwc7

Parsing issue in protobuf message-type extension

Published Nov 11, 2022 · Updated Apr 22, 2025 · Assigned by Google

Vendor: Google Product: Protocolbuffers Package: celeborn-0.6 Package: com.google.protobuf:protobuf-java Package: com.google.protobuf:protobuf-javalite Package: druid Package: protobuf Package: protobuf Package: trino Package: trino-config Package: trino-oci-entrypoint Package: trino-plugin-ai-functions Package: trino-plugin-bigquery Package: trino-plugin-blackhole Package: trino-plugin-cassandra Package: trino-plugin-clickhouse Package: trino-plugin-delta-lake Package: trino-plugin-druid Package: trino-plugin-duckdb Package: trino-plugin-elasticsearch Package: trino-plugin-exasol Package: trino-plugin-exchange-filesystem Package: trino-plugin-exchange-hdfs Package: trino-plugin-faker Package: trino-plugin-functions-python Package: trino-plugin-geospatial Package: trino-plugin-google-sheets Package: trino-plugin-hive Package: trino-plugin-http-event-listener Package: trino-plugin-http-server-event-listener Package: trino-plugin-hudi Package: trino-plugin-iceberg Package: trino-plugin-ignite Package: trino-plugin-jmx Package: trino-plugin-kafka Package: trino-plugin-kafka-event-listener Package: trino-plugin-lakehouse Package: trino-plugin-ldap-group-provider Package: trino-plugin-loki Package: trino-plugin-mariadb Package: trino-plugin-memory Package: trino-plugin-ml Package: trino-plugin-mongodb Package: trino-plugin-mysql Package: trino-plugin-mysql-event-listener Package: trino-plugin-opa Package: trino-plugin-openlineage Package: trino-plugin-opensearch Package: trino-plugin-oracle Package: trino-plugin-password-authenticators Package: trino-plugin-pinot Package: trino-plugin-postgresql Package: trino-plugin-prometheus Package: trino-plugin-ranger Package: trino-plugin-redis Package: trino-plugin-redshift Package: trino-plugin-resource-group-managers Package: trino-plugin-session-property-managers Package: trino-plugin-singlestore Package: trino-plugin-snowflake Package: trino-plugin-spooling-filesystem Package: trino-plugin-sqlserver Package: trino-plugin-teradata-functions Package: trino-plugin-thrift Package: trino-plugin-tpcds Package: trino-plugin-tpch Package: trino-plugin-vertica Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu Ecosystem: Wolfi

Description

A parsing issue similar to CVE-2022-3171, but with Message-Type Extensions in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.

Affected products

VendorProductAffectedFixed
Google ProtocolBuffers 3.21.0 – < 3.21.7, 3.20.0 – < 3.20.3, 3.19.0 – < 3.19.6, 3.16.0 – < 3.16.3 3.21.7

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 protobuf 3.21.9-3 —
Debian 13 protobuf 3.21.9-3 —
Debian 12 protobuf 3.21.9-3 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS protobuf No fix yet —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS protobuf No fix yet —
Ubuntu Pro 18.04 LTS protobuf No fix yet —
Ubuntu Pro 16.04 LTS protobuf No fix yet —
Ubuntu Pro 14.04 LTS protobuf No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling celeborn-0.6 0.6.3-r7 —
Wolfi rolling druid 34.0.0-r6 —
Wolfi rolling trino +58 439-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven com.google.protobuf:protobuf-java >= 3.0.0, < 3.16.3 3.16.3 GHSA-4gg5-vx3j-xwc7
Maven com.google.protobuf:protobuf-java >= 3.17.0, < 3.19.6 3.19.6 GHSA-4gg5-vx3j-xwc7
Maven com.google.protobuf:protobuf-java >= 3.20.0, < 3.20.3 3.20.3 GHSA-4gg5-vx3j-xwc7
Maven com.google.protobuf:protobuf-java >= 3.21.0, < 3.21.7 3.21.7 GHSA-4gg5-vx3j-xwc7
Maven com.google.protobuf:protobuf-javalite >= 3.0.0, < 3.16.3 3.16.3 GHSA-4gg5-vx3j-xwc7
Maven com.google.protobuf:protobuf-javalite >= 3.17.0, < 3.19.6 3.19.6 GHSA-4gg5-vx3j-xwc7
Maven com.google.protobuf:protobuf-javalite >= 3.20.0, < 3.20.3 3.20.3 GHSA-4gg5-vx3j-xwc7
Maven com.google.protobuf:protobuf-javalite >= 3.21.0, < 3.21.7 3.21.7 GHSA-4gg5-vx3j-xwc7

Advisories 5

References