Vulnerability Database
289,599
Total vulnerabilities in the database
CVE-2021-22569
An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated pauses. We recommend upgrading libraries beyond the vulnerable versions.
| Software | From | Fixed in |
|---|---|---|
| google / protobuf-kotlin | 3.19.0 | 3.19.2 |
| google / protobuf-kotlin | - | 3.18.2 |
| google / protobuf-java | - | 3.16.1 |
| google / protobuf-java | 3.18.0 | 3.18.2 |
| google / protobuf-java | 3.19.0 | 3.19.2 |
| google / google-protobuf | - | 3.19.2 |
| oracle / communications_cloud_native_core_console | 1.9.0 | 1.9.0.x |
| oracle / communications_cloud_native_core_policy | 1.15.0 | 1.15.0.x |
| oracle / communications_cloud_native_core_network_repository_function | 1.15.0 | 1.15.0.x |
| oracle / communications_cloud_native_core_network_repository_function | 1.15.1 | 1.15.1.x |
| oracle / spatial_and_graph_mapviewer | 21c | 21c.x |
| oracle / spatial_and_graph_mapviewer | 19c | 19c.x |
com.google.protobuf / protobuf-java
|
- | 3.16.1 |
google-protobuf
|
- | 3.19.2 |
|
com.google.protobuf / protobuf-java
|
3.18.0 | 3.18.2 |
|
com.google.protobuf / protobuf-java
|
3.19.0 | 3.19.2 |
|
com.google.protobuf / protobuf-kotlin
|
3.18.0 | 3.18.2 |
|
com.google.protobuf / protobuf-kotlin
|
3.19.0 | 3.19.2 |
- http://www.openwall.com/lists/oss-security/2022/01/12/4
- http://www.openwall.com/lists/oss-security/2022/01/12/7
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39330
- https://cloud.google.com/support/bulletins#gcp-2022-001
- https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-wrvw-hg22-4m67
- https://lists.debian.org/debian-lts-announce/2023/04/msg00019.html
- https://www.oracle.com/security-alerts/cpuapr2022.html