CVE-2021-22569

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated pauses. We recommend upgrading libraries beyond the vulnerable versions.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-696

Affected software

Vendor	Product	Versions
Google LLC	protobuf-java	>= unspecified, < 3.16.1; >= unspecified, < 3.18.2; >= unspecified, < 3.19.2
Google LLC	protobuf-kotlin	>= unspecified, < 3.18.2; >= unspecified, < 3.19.2
Google LLC	google-protobuf [JRuby Gem]	>= unspecified, < 3.19.2

References

http://www.openwall.com/lists/oss-security/2022/01/12/4Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/01/12/7Mailing List, Third Party Advisory
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39330Exploit, Issue Tracking, Mailing List, Vendor Advisory
https://cloud.google.com/support/bulletins#gcp-2022-001Vendor Advisory
https://lists.debian.org/debian-lts-announce/2023/04/msg00019.html
https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/01/12/4Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/01/12/7Mailing List, Third Party Advisory
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39330Exploit, Issue Tracking, Mailing List, Vendor Advisory
https://cloud.google.com/support/bulletins#gcp-2022-001Vendor Advisory
https://lists.debian.org/debian-lts-announce/2023/04/msg00019.html
https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory

Timeline

Published: Jan 10, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-22574.1Vulnerability in the Oracle Storage Cloud Software Appliance product of Oracle Storage Gateway (component: Management Console). The supporte CVE-2021-225705.5Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the p CVE-2021-225715.5A local attacker could read files from some other users' SA360 reports stored in the /tmp folder during staging process before the files are CVE-2021-225725.5On unix-like systems, the system temporary directory is shared between all users on that system. The root cause is File.createTempFile creat CVE-2021-225737.3The vulnerability is that IDToken verifier does not verify if token is properly signed. Signature verification makes sure that the token's p CVE-2021-22588.1Vulnerability in the Oracle Projects product of Oracle E-Business Suite (component: User Interface). Supported versions that are affected ar CVE-2021-22598.1Vulnerability in the Oracle Payables product of Oracle E-Business Suite (component: India Localization, Results). Supported versions that ar CVE-2021-22608.1Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: iRecruitment). The supported version that is affe CVE-2021-226007.0A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privi CVE-2021-22618.1Vulnerability in the Oracle Lease and Finance Management product of Oracle E-Business Suite (component: Quotes). Supported versions that are CVE-2021-22628.1Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Endeca). The supported version that is affected is 12.CVE-2021-22638.1Vulnerability in the Oracle Sourcing product of Oracle E-Business Suite (component: Intelligence, RFx). Supported versions that are affected