CVE-2022-3171 — Vulnerability in...
MEDIUM
protobuf-java has a potential Denial of Service issue
Published October 4, 2022Updated September 10, 2026Source: osv
Summary
## Summary
A potential Denial of Service issue in `protobuf-java` core and lite was discovered in the parsing procedure for binary and text format data. Input streams containing multiple instances of non-repeated [embedded messages](http://developers.google.com/protocol-buffers/docs/encoding#embedded) with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses.
Reporter: [OSS Fuzz](https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48771)
Affected versions: This issue affects both the Java full and lite Protobuf runtimes, as well as Protobuf for Kotlin and JRuby, which themselves use the Java Protobuf runtime.
## Severity
[CVE-2022-3171](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3171) Medium - CVSS Score: 5.7 (NOTE: there may be a delay in publication)
## Remediation and Mitigation
Please update to the latest available versions of the following packages:
protobuf-java (3.21.7, 3.20.3, 3.19.6, 3.16.3)
protobuf-javalite (3.21.7, 3.20.3, 3.19.6, 3.16.3)
protobuf-kotlin (3.21.7, 3.20.3, 3.19.6, 3.16.3)
protobuf-kotlin-lite (3.21.7, 3.20.3, 3.19.6, 3.16.3)
google-protobuf [JRuby gem only] (3.21.7, 3.20.3, 3.19.6)
Advisory Timeline
- First published October 4, 2022 (1469 days ago).
- Last revised September 10, 2026 — 1436 days after initial publication.
Remediation
Upgrade to the fixed version using your package manager.
Maven
Update com.google.protobuf:protobuf-javalite to 3.16.3 or later<!-- Update pom.xml dependency version to 3.16.3 for com.google.protobuf:protobuf-javalite -->
Bundler
Update google-protobuf to 3.21.7 or latergem install google-protobuf -v 3.21.7
Maven
Update com.google.protobuf:protobuf-java to 3.16.3 or later<!-- Update pom.xml dependency version to 3.16.3 for com.google.protobuf:protobuf-java -->
Maven
Update com.google.protobuf:protobuf-javalite to 3.21.7 or later<!-- Update pom.xml dependency version to 3.21.7 for com.google.protobuf:protobuf-javalite -->
Maven
Update com.google.protobuf:protobuf-kotlin-lite to 3.19.6 or later<!-- Update pom.xml dependency version to 3.19.6 for com.google.protobuf:protobuf-kotlin-lite -->
Maven
Update com.google.protobuf:protobuf-javalite to 3.20.3 or later<!-- Update pom.xml dependency version to 3.20.3 for com.google.protobuf:protobuf-javalite -->
Maven
Update com.google.protobuf:protobuf-kotlin to 3.19.6 or later<!-- Update pom.xml dependency version to 3.19.6 for com.google.protobuf:protobuf-kotlin -->
Maven
Update com.google.protobuf:protobuf-javalite to 3.19.6 or later<!-- Update pom.xml dependency version to 3.19.6 for com.google.protobuf:protobuf-javalite -->
Bundler
Update google-protobuf to 3.19.6 or latergem install google-protobuf -v 3.19.6
Maven
Update com.google.protobuf:protobuf-java to 3.21.7 or later<!-- Update pom.xml dependency version to 3.21.7 for com.google.protobuf:protobuf-java -->
Bundler
Update google-protobuf to 3.16.3 or latergem install google-protobuf -v 3.16.3
Maven
Update com.google.protobuf:protobuf-kotlin to 3.20.3 or later<!-- Update pom.xml dependency version to 3.20.3 for com.google.protobuf:protobuf-kotlin -->
Bundler
Update google-protobuf to 3.20.3 or latergem install google-protobuf -v 3.20.3
Maven
Update com.google.protobuf:protobuf-java to 3.20.3 or later<!-- Update pom.xml dependency version to 3.20.3 for com.google.protobuf:protobuf-java -->
Maven
Update com.google.protobuf:protobuf-kotlin to 3.21.7 or later<!-- Update pom.xml dependency version to 3.21.7 for com.google.protobuf:protobuf-kotlin -->
Maven
Update com.google.protobuf:protobuf-kotlin to 3.16.3 or later<!-- Update pom.xml dependency version to 3.16.3 for com.google.protobuf:protobuf-kotlin -->
Maven
Update com.google.protobuf:protobuf-java to 3.19.6 or later<!-- Update pom.xml dependency version to 3.19.6 for com.google.protobuf:protobuf-java -->
Maven
Update com.google.protobuf:protobuf-kotlin-lite to 3.21.7 or later<!-- Update pom.xml dependency version to 3.21.7 for com.google.protobuf:protobuf-kotlin-lite -->
Maven
Update com.google.protobuf:protobuf-kotlin-lite to 3.20.3 or later<!-- Update pom.xml dependency version to 3.20.3 for com.google.protobuf:protobuf-kotlin-lite -->
Maven
Update com.google.protobuf:protobuf-kotlin-lite to 3.16.3 or later<!-- Update pom.xml dependency version to 3.16.3 for com.google.protobuf:protobuf-kotlin-lite -->
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (20)
Affects 2 ecosystems: maven (4), rubygems (1).
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| com.google.protobuf:protobuf-javalite | maven | 3.10.0, 3.10.0-rc-1, 3.11.0, 3.11.0-rc-1 (+37 more) | 3.16.3 |
| google-protobuf | rubygems | 3.21.0, 3.21.0.rc.1, 3.21.0.rc.2, 3.21.1 (+5 more) | 3.21.7 |
| com.google.protobuf:protobuf-java | maven | 2.0.1, 2.0.3, 2.1.0, 2.2.0 (+70 more) | 3.16.3 |
| com.google.protobuf:protobuf-javalite | maven | 3.21.0, 3.21.0-rc-1, 3.21.0-rc-2, 3.21.1 (+5 more) | 3.21.7 |
| com.google.protobuf:protobuf-kotlin-lite | maven | 3.17.0, 3.17.0-rc-2, 3.17.1, 3.17.2 (+15 more) | 3.19.6 |
| com.google.protobuf:protobuf-javalite | maven | 3.20.0, 3.20.0-rc-1, 3.20.1, 3.20.1-rc-1 (+1 more) | 3.20.3 |
| com.google.protobuf:protobuf-kotlin | maven | 3.17.0, 3.17.0-rc-2, 3.17.1, 3.17.2 (+15 more) | 3.19.6 |
| com.google.protobuf:protobuf-javalite | maven | 3.17.0, 3.17.0-rc-1, 3.17.0-rc-2, 3.17.1 (+16 more) | 3.19.6 |
| google-protobuf | rubygems | 3.17.0, 3.17.0.rc.1, 3.17.0.rc.2, 3.17.1 (+16 more) | 3.19.6 |
| com.google.protobuf:protobuf-java | maven | 3.21.0, 3.21.0-rc-1, 3.21.0-rc-2, 3.21.1 (+5 more) | 3.21.7 |
| google-protobuf | rubygems | 3.0.0, 3.0.0.alpha.1.0, 3.0.0.alpha.1.1, 3.0.0.alpha.2.0 (+70 more) | 3.16.3 |
| com.google.protobuf:protobuf-kotlin | maven | 3.20.0, 3.20.0-rc-1, 3.20.1, 3.20.1-rc-1 (+1 more) | 3.20.3 |
| google-protobuf | rubygems | 3.20.0, 3.20.0.rc.1, 3.20.0.rc.2, 3.20.1 (+2 more) | 3.20.3 |
| com.google.protobuf:protobuf-java | maven | 3.20.0, 3.20.0-rc-1, 3.20.1, 3.20.1-rc-1 (+1 more) | 3.20.3 |
| com.google.protobuf:protobuf-kotlin | maven | 3.21.0, 3.21.0-rc-1, 3.21.0-rc-2, 3.21.1 (+5 more) | 3.21.7 |
| com.google.protobuf:protobuf-kotlin | maven | All versions | 3.16.3 |
| com.google.protobuf:protobuf-java | maven | 3.17.0, 3.17.0-rc-1, 3.17.0-rc-2, 3.17.1 (+16 more) | 3.19.6 |
| com.google.protobuf:protobuf-kotlin-lite | maven | 3.21.0, 3.21.0-rc-1, 3.21.0-rc-2, 3.21.1 (+5 more) | 3.21.7 |
| com.google.protobuf:protobuf-kotlin-lite | maven | 3.20.0, 3.20.0-rc-1, 3.20.1, 3.20.1-rc-1 (+1 more) | 3.20.3 |
| com.google.protobuf:protobuf-kotlin-lite | maven | All versions | 3.16.3 |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-20Improper Input ValidationMITRE
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 5.7 score means for each attack dimension.
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-h4h5-3hr4-j3g2WEB
- https://nvd.nist.gov/vuln/detail/CVE-2022-3171ADVISORY
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48771WEB
- https://github.com/protocolbuffers/protobufPACKAGE
- https://github.com/protocolbuffers/protobuf/releases/tag/v21.7WEB
- https://github.com/protocolbuffers/protobuf/releases/tag/v3.16.3WEB
- https://github.com/protocolbuffers/protobuf/releases/tag/v3.19.6WEB
- https://github.com/protocolbuffers/protobuf/releases/tag/v3.20.3WEB
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/google-protobuf/CVE-2022-3171.ymlWEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CBAUKJQL6O4TIWYBENORSY5P43TVB4M3WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MPCGUT3T5L6C3IDWUPSUO22QDCGQKTOPWEB
- https://security.gentoo.org/glsa/202301-09WEB
Frequently Asked Questions
- What is CVE-2022-3171?
- protobuf-java has a potential Denial of Service issue This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 5.7/10).
- How do I check if my project is affected by CVE-2022-3171?
- CVE-2022-3171 affects com.google.protobuf:protobuf-javalite, google-protobuf and com.google.protobuf:protobuf-java (and 2 more). Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2022-3171 and 200,000+ other known vulnerabilities.
Severity & Exploitability
CVSS Score
5.7
Exploitation requires specific conditions or has limited impact. Remediate within weeks.
Also Known As
GHSA-h4h5-3hr4-j3g2
Related CVEs
- CVE-2024-7254HIGH
protobuf-java has potential Denial of Service issue
- CVE-2015-5237HIGH
protobuf susceptible to buffer overflow
- CVE-2021-22569HIGH
A potential Denial of Service issue in protobuf-java
- CVE-2026-107715MEDIUM
Mechanize sends credential headers to another host after an HTTP redirect
- CVE-2026-107399MEDIUM
Mechanize sends credential headers to another origin after a meta refresh
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies