CVE-2022-3509: Parsing issue in protobuf textformat
A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.
Other sources
protobuf-java core and lite are vulnerable to a denial of service, caused by a flaw in the parsing procedure for textformat data. By sending non-repeated embedded messages with repeated or unknown fields, a remote authenticated attacker could exploit this vulnerability to cause long garbage collection pauses.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-3509?
CVE-2022-3509 is a vulnerability in protobuf-java core and lite that allows a remote authenticated attacker to cause a denial of service by exploiting a flaw in the parsing procedure for textformat data.
What is the severity of CVE-2022-3509?
The severity of CVE-2022-3509 is medium with a CVSS score of 5.7.
How can an attacker exploit CVE-2022-3509?
An attacker can exploit CVE-2022-3509 by sending non-repeated embedded messages with repeated or unknown fields.
Which software versions are affected by CVE-2022-3509?
The affected software versions are protobuf-java 3.21.7, 3.20.3, 3.19.6, and 3.16.3.
How do I fix CVE-2022-3509?
To fix CVE-2022-3509, update protobuf-java to version 3.21.7 or apply the appropriate fix provided by the vendor.