CVE-2022-3509 Parsing issue in protobuf textformat
Attackers can cause denial of service via long garbage collection pauses by sending crafted protobuf textformat inputs to applications using vulnerable Java libraries.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-3509?
CVE-2022-3509 is a high-severity denial of service vulnerability in Google ProtocolBuffers, published on 1 Nov 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.
Weakness: CWE-400
Which versions are affected by CVE-2022-3509?
14 open source packages ship an affected version, including com.google.protobuf:protobuf-java and com.google.protobuf:protobuf-javalite. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
com.google.protobuf:protobuf-java Maven | From 3.0.0 | 3.16.3 |
com.google.protobuf:protobuf-java Maven | From 3.0.0 | 3.16.3 |
com.google.protobuf:protobuf-java Maven | From 3.17.0 | 3.19.6 |
com.google.protobuf:protobuf-java Maven | From 3.17.0 | 3.19.6 |
com.google.protobuf:protobuf-java Maven | From 3.20.0 | 3.20.3 |
com.google.protobuf:protobuf-java Maven | From 3.20.0 | 3.20.3 |
8 more packages
com.google.protobuf:protobuf-java Maven | From 3.21.0 | 3.21.7 |
com.google.protobuf:protobuf-java Maven | From 3.21.0 | 3.21.7 |
com.google.protobuf:protobuf-javalite Maven | From 3.0.0 | 3.16.3 |
com.google.protobuf:protobuf-javalite Maven | From 3.0.0 | 3.16.3 |
com.google.protobuf:protobuf-javalite Maven | From 3.20.0 | 3.20.3 |
com.google.protobuf:protobuf-javalite Maven | From 3.20.0 | 3.20.3 |
com.google.protobuf:protobuf-javalite Maven | From 3.21.0 | 3.21.7 |
com.google.protobuf:protobuf-javalite Maven | From 3.21.0 | 3.21.7 |
Products include Google Protobuf-Java, Google Protobuf-Javalite.
How do I fix CVE-2022-3509?
Upgrade com.google.protobuf:protobuf-java to a fixed version for your release line: 3.16.3, 3.19.6, 3.20.3 or 3.21.7.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-3509 being exploited?
There is no known exploitation of CVE-2022-3509 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Google ProtocolBuffers
Sources
Also known as CLEANSTART-2026-HK32575, CLEANSTART-2026-RG72444, CLSA-2026-1777250321, CLSA-2026-1791960535, CLSA-2026-1791965654, DEBIAN-CVE-2022-3509 and 11 more.