{"id":"GHSA-g5ww-5jh7-63cx","summary":"Protobuf Java vulnerable to Uncontrolled Resource Consumption","details":"A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.","aliases":["CVE-2022-3509"],"modified":"2026-07-17T21:17:25.167087343Z","published":"2022-12-12T15:30:33Z","database_specific":{"github_reviewed_at":"2022-12-12T22:33:53Z","nvd_published_at":"2022-12-12T13:15:00Z","cwe_ids":["CWE-400"],"severity":"HIGH","github_reviewed":true},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3509"},{"type":"WEB","url":"https://github.com/protocolbuffers/protobuf/commit/a3888f53317a8018e7a439bac4abeb8f3425d5e9"},{"type":"WEB","url":"https://github.com/protocolbuffers/protobuf/blob/v2.6.1/java/core/src/main/java/com/google/protobuf/MessageReflection.java"},{"type":"WEB","url":"https://github.com/protocolbuffers/protobuf/blob/v3.0.0/java/core/src/main/java/com/google/protobuf/MessageReflection.java"},{"type":"PACKAGE","url":"https://github.com/protocolbuffers/protobuf/tree/main/java"}],"affected":[{"package":{"name":"com.google.protobuf:protobuf-java","ecosystem":"Maven","purl":"pkg:maven/com.google.protobuf/protobuf-java"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.16.3"}]}],"versions":["3.0.0","3.0.2","3.1.0","3.10.0","3.10.0-rc-1","3.11.0","3.11.0-rc-1","3.11.0-rc-2","3.11.1","3.11.3","3.11.4","3.12.0","3.12.0-rc-1","3.12.0-rc-2","3.12.1","3.12.2","3.12.4","3.13.0","3.13.0-rc-3","3.14.0","3.14.0-rc-1","3.14.0-rc-2","3.14.0-rc-3","3.15.0","3.15.0-rc-1","3.15.0-rc-2","3.15.1","3.15.2","3.15.3","3.15.4","3.15.5","3.15.6","3.15.7","3.15.8","3.16.0","3.16.0-rc-1","3.16.0-rc-2","3.16.1","3.2.0","3.2.0-rc.1","3.2.0rc2","3.3.0","3.3.1","3.4.0","3.5.0","3.5.1","3.6.0","3.6.1","3.7.0","3.7.0-rc1","3.7.1","3.8.0","3.8.0-rc-1","3.9.0","3.9.0-rc-1","3.9.1","3.9.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-g5ww-5jh7-63cx/GHSA-g5ww-5jh7-63cx.json"}},{"package":{"name":"com.google.protobuf:protobuf-java","ecosystem":"Maven","purl":"pkg:maven/com.google.protobuf/protobuf-java"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.17.0"},{"fixed":"3.19.6"}]}],"versions":["3.17.0","3.17.1","3.17.2","3.17.3","3.18.0","3.18.0-rc-1","3.18.0-rc-2","3.18.1","3.18.2","3.18.3","3.19.0","3.19.0-rc-1","3.19.0-rc-2","3.19.1","3.19.2","3.19.3","3.19.4","3.19.5"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-g5ww-5jh7-63cx/GHSA-g5ww-5jh7-63cx.json"}},{"package":{"name":"com.google.protobuf:protobuf-java","ecosystem":"Maven","purl":"pkg:maven/com.google.protobuf/protobuf-java"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.20.0"},{"fixed":"3.20.3"}]}],"versions":["3.20.0","3.20.1","3.20.1-rc-1","3.20.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-g5ww-5jh7-63cx/GHSA-g5ww-5jh7-63cx.json"}},{"package":{"name":"com.google.protobuf:protobuf-java","ecosystem":"Maven","purl":"pkg:maven/com.google.protobuf/protobuf-java"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.21.0"},{"fixed":"3.21.7"}]}],"versions":["3.21.0","3.21.1","3.21.2","3.21.3","3.21.4","3.21.5","3.21.6"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-g5ww-5jh7-63cx/GHSA-g5ww-5jh7-63cx.json"}},{"package":{"name":"com.google.protobuf:protobuf-javalite","ecosystem":"Maven","purl":"pkg:maven/com.google.protobuf/protobuf-javalite"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.20.0"},{"fixed":"3.20.3"}]}],"versions":["3.20.0","3.20.1","3.20.1-rc-1","3.20.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-g5ww-5jh7-63cx/GHSA-g5ww-5jh7-63cx.json"}},{"package":{"name":"com.google.protobuf:protobuf-javalite","ecosystem":"Maven","purl":"pkg:maven/com.google.protobuf/protobuf-javalite"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.21.0"},{"fixed":"3.21.7"}]}],"versions":["3.21.0","3.21.1","3.21.2","3.21.3","3.21.4","3.21.5","3.21.6"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-g5ww-5jh7-63cx/GHSA-g5ww-5jh7-63cx.json"}},{"package":{"name":"com.google.protobuf:protobuf-javalite","ecosystem":"Maven","purl":"pkg:maven/com.google.protobuf/protobuf-javalite"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.16.3"}]}],"versions":["3.10.0","3.10.0-rc-1","3.11.0","3.11.0-rc-1","3.11.0-rc-2","3.11.1","3.11.3","3.11.4","3.12.0","3.12.0-rc-1","3.12.0-rc-2","3.12.1","3.12.2","3.12.4","3.13.0","3.13.0-rc-3","3.14.0","3.14.0-rc-1","3.14.0-rc-2","3.14.0-rc-3","3.15.0","3.15.0-rc-1","3.15.0-rc-2","3.15.1","3.15.2","3.15.3","3.15.4","3.15.5","3.15.6","3.15.7","3.15.8","3.16.0","3.16.0-rc-1","3.16.0-rc-2","3.16.1","3.8.0","3.8.0-rc-1","3.9.0","3.9.0-rc-1","3.9.1","3.9.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-g5ww-5jh7-63cx/GHSA-g5ww-5jh7-63cx.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}