{"id":"GHSA-4gg5-vx3j-xwc7","summary":"Protobuf Java vulnerable to Uncontrolled Resource Consumption","details":"A parsing issue similar to CVE-2022-3171, but with Message-Type Extensions in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.","aliases":["CVE-2022-3510"],"modified":"2026-07-17T21:16:15.069435529Z","published":"2022-12-12T15:30:33Z","database_specific":{"github_reviewed_at":"2022-12-12T22:34:26Z","nvd_published_at":"2022-12-12T13:15:00Z","cwe_ids":["CWE-400"],"severity":"HIGH","github_reviewed":true},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3510"},{"type":"WEB","url":"https://github.com/protocolbuffers/protobuf/commit/db7c17803320525722f45c1d26fc08bc41d1bf48"},{"type":"PACKAGE","url":"https://github.com/protocolbuffers/protobuf/tree/main/java"}],"affected":[{"package":{"name":"com.google.protobuf:protobuf-java","ecosystem":"Maven","purl":"pkg:maven/com.google.protobuf/protobuf-java"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.16.3"}]}],"versions":["3.0.0","3.0.2","3.1.0","3.10.0","3.10.0-rc-1","3.11.0","3.11.0-rc-1","3.11.0-rc-2","3.11.1","3.11.3","3.11.4","3.12.0","3.12.0-rc-1","3.12.0-rc-2","3.12.1","3.12.2","3.12.4","3.13.0","3.13.0-rc-3","3.14.0","3.14.0-rc-1","3.14.0-rc-2","3.14.0-rc-3","3.15.0","3.15.0-rc-1","3.15.0-rc-2","3.15.1","3.15.2","3.15.3","3.15.4","3.15.5","3.15.6","3.15.7","3.15.8","3.16.0","3.16.0-rc-1","3.16.0-rc-2","3.16.1","3.2.0","3.2.0-rc.1","3.2.0rc2","3.3.0","3.3.1","3.4.0","3.5.0","3.5.1","3.6.0","3.6.1","3.7.0","3.7.0-rc1","3.7.1","3.8.0","3.8.0-rc-1","3.9.0","3.9.0-rc-1","3.9.1","3.9.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-4gg5-vx3j-xwc7/GHSA-4gg5-vx3j-xwc7.json"}},{"package":{"name":"com.google.protobuf:protobuf-java","ecosystem":"Maven","purl":"pkg:maven/com.google.protobuf/protobuf-java"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.17.0"},{"fixed":"3.19.6"}]}],"versions":["3.17.0","3.17.1","3.17.2","3.17.3","3.18.0","3.18.0-rc-1","3.18.0-rc-2","3.18.1","3.18.2","3.18.3","3.19.0","3.19.0-rc-1","3.19.0-rc-2","3.19.1","3.19.2","3.19.3","3.19.4","3.19.5"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-4gg5-vx3j-xwc7/GHSA-4gg5-vx3j-xwc7.json"}},{"package":{"name":"com.google.protobuf:protobuf-java","ecosystem":"Maven","purl":"pkg:maven/com.google.protobuf/protobuf-java"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.20.0"},{"fixed":"3.20.3"}]}],"versions":["3.20.0","3.20.1","3.20.1-rc-1","3.20.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-4gg5-vx3j-xwc7/GHSA-4gg5-vx3j-xwc7.json"}},{"package":{"name":"com.google.protobuf:protobuf-java","ecosystem":"Maven","purl":"pkg:maven/com.google.protobuf/protobuf-java"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.21.0"},{"fixed":"3.21.7"}]}],"versions":["3.21.0","3.21.1","3.21.2","3.21.3","3.21.4","3.21.5","3.21.6"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-4gg5-vx3j-xwc7/GHSA-4gg5-vx3j-xwc7.json"}},{"package":{"name":"com.google.protobuf:protobuf-javalite","ecosystem":"Maven","purl":"pkg:maven/com.google.protobuf/protobuf-javalite"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.16.3"}]}],"versions":["3.10.0","3.10.0-rc-1","3.11.0","3.11.0-rc-1","3.11.0-rc-2","3.11.1","3.11.3","3.11.4","3.12.0","3.12.0-rc-1","3.12.0-rc-2","3.12.1","3.12.2","3.12.4","3.13.0","3.13.0-rc-3","3.14.0","3.14.0-rc-1","3.14.0-rc-2","3.14.0-rc-3","3.15.0","3.15.0-rc-1","3.15.0-rc-2","3.15.1","3.15.2","3.15.3","3.15.4","3.15.5","3.15.6","3.15.7","3.15.8","3.16.0","3.16.0-rc-1","3.16.0-rc-2","3.16.1","3.8.0","3.8.0-rc-1","3.9.0","3.9.0-rc-1","3.9.1","3.9.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-4gg5-vx3j-xwc7/GHSA-4gg5-vx3j-xwc7.json"}},{"package":{"name":"com.google.protobuf:protobuf-javalite","ecosystem":"Maven","purl":"pkg:maven/com.google.protobuf/protobuf-javalite"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.17.0"},{"fixed":"3.19.6"}]}],"versions":["3.17.0","3.17.1","3.17.2","3.17.3","3.18.0","3.18.0-rc-1","3.18.0-rc-2","3.18.1","3.18.2","3.18.3","3.19.0","3.19.0-rc-1","3.19.0-rc-2","3.19.1","3.19.2","3.19.3","3.19.4","3.19.5"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-4gg5-vx3j-xwc7/GHSA-4gg5-vx3j-xwc7.json"}},{"package":{"name":"com.google.protobuf:protobuf-javalite","ecosystem":"Maven","purl":"pkg:maven/com.google.protobuf/protobuf-javalite"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.20.0"},{"fixed":"3.20.3"}]}],"versions":["3.20.0","3.20.1","3.20.1-rc-1","3.20.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-4gg5-vx3j-xwc7/GHSA-4gg5-vx3j-xwc7.json"}},{"package":{"name":"com.google.protobuf:protobuf-javalite","ecosystem":"Maven","purl":"pkg:maven/com.google.protobuf/protobuf-javalite"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.21.0"},{"fixed":"3.21.7"}]}],"versions":["3.21.0","3.21.1","3.21.2","3.21.3","3.21.4","3.21.5","3.21.6"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-4gg5-vx3j-xwc7/GHSA-4gg5-vx3j-xwc7.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}