CVE-2022-3510: Parsing issue in protobuf message-type extension
A parsing issue similar to CVE-2022-3171, but with Message-Type Extensions in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.
Other sources
protobuf-java core and lite are vulnerable to a denial of service, caused by a flaw in the parsing procedure for Message-Type Extensions. By sending non-repeated embedded messages with repeated or unknown fields, a remote authenticated attacker could exploit this vulnerability to cause long garbage collection pauses.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-3510?
CVE-2022-3510 is a vulnerability in protobuf-java core and lite that allows a remote authenticated attacker to cause a denial of service.
How can an attacker exploit CVE-2022-3510?
An attacker can exploit CVE-2022-3510 by sending non-repeated embedded messages with repeated or unknown fields.
What is the severity of CVE-2022-3510?
The severity of CVE-2022-3510 is medium with a CVSS score of 5.7.
Which versions of protobuf-java are affected by CVE-2022-3510?
Protobuf-java versions 3.21.7, 3.20.3, 3.19.6, and 3.16.3 are affected by CVE-2022-3510.
How can I fix CVE-2022-3510?
To fix CVE-2022-3510, update protobuf-java to version 3.21.7 or apply the appropriate remedy provided by the vendor.