WaratekVRT Sign in

CVE-2022-3171 protobuf-java

Affected softwareprotobuf-java
Severity7.5 High CVSS 3.1 2 scores
Fixed in3.21.7, 3.20.3, 3.19.6, 3.16.3
WeaknessImproper input validation (CWE-20)
Published12 Oct 2022
Updated17 Jun 2026

Description

A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 4 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC none indexed
  • EPSS 1.3% chance in 30 days

Waratek protection

No exploit published

Within Waratek scope. In the sources we check, nobody has published exploit code for this CVE or reported it being exploited.

VRT has not found a public code change for this CVE yet.

  • Protection none
  • Action not pursued
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to No source fix or exploit.

CVSS

7.5 HIGH v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H NVD Primary published
CVSS 3.1 4.3 MEDIUM CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L cve-coordination@google.com Secondary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update July 2026 ↗ CPU 2026-Q3 Oracle Communications / Core (Google Protobuf-Java) (6.1.1-7.0.0)
Oracle Siebel CRM / Server Infrastructure (Apache ZooKeeper) (17.0-26.5)
Oracle Critical Patch Update October 2023 ↗ CPU 2023-Q4 Oracle Financial Services Applications / Security (Google Protobuf-Java) (2.9.0)
Oracle GoldenGate / Veridata (Google Protobuf-Java) (12.2.1.4.0-12.2.1.4.230922)
Oracle Critical Patch Update July 2023 ↗ CPU 2023-Q3 Oracle Financial Services Applications / Accessibility (Google Protobuf-Java) (14.7.0.2.0, 14.7.1.0.0)
Oracle Financial Services Applications / Common (Google Protobuf-Java) (14.5.0.8.0, 14.6.0.4.0, 14.7.0.2.0, 14.7.1.0.0)
Oracle Financial Services Applications / Common (Google Protobuf-Java) (14.7.1.0.0)
Oracle Financial Services Applications / Dashboard (Google Protobuf-Java) (14.5.0.8.0, 14.6.0.4.0, 14.7.0.2.0, 14.7.1.0.0)
Oracle Financial Services Applications / Security (Google Protobuf-Java) (14.7.0.2.0, 14.7.1.0.0)
Oracle Critical Patch Update April 2023 ↗ CPU 2023-Q2 Oracle Communications / Core (Google Protobuf-Java) (12.6.0.0.0)
Oracle Communications Applications / Core (Google Protobuf-Java) (5.5.0-5.5.9, 6.0.0-6.0.1)
Oracle Financial Services Applications / Core (Google Protobuf-Java) (14.0-14.3, 14.5-14.7)
Oracle Financial Services Applications / Infra Code (Google Protobuf-Java) (14.5, 14.6, 14.7)
Oracle Financial Services Applications / Infrastructure (Google Protobuf-Java) (14.0-14.3, 14.5-14.7)
Oracle Financial Services Applications / Infrastructure (Google Protobuf-Java) (14.5, 14.6, 14.7)
Oracle Financial Services Applications / Infrastructure (Google Protobuf-Java) (14.5, 14.6, 14.7)
Oracle HealthCare Applications / DataStudio (Google Protobuf-Java) (4.1.0, 4.1.1)
Oracle Retail Applications / Internal Operations (Google Protobuf-Java) (18.0.0.12, 19.0.0.6)
Oracle Critical Patch Update January 2023 ↗ CPU 2023-Q1 Oracle Communications / Configuration (Google Protobuf-Java) (22.3.0)
Oracle Communications / Installation (Google Protobuf-Java) (22.3.2)
Oracle Communications / Platform (Google Protobuf-Java) (22.3.1)
Oracle Communications / Platform (Google Protobuf-Java) (22.3.1)
Oracle Communications / Policy (Google Protobuf-Java) (22.3.0)
Oracle Communications / Signaling (Google Protobuf-Java) (22.2.2, 22.3.3)
Oracle Communications / Signaling (Google Protobuf-Java) (22.3.1)
Oracle Communications Applications / Policy (Google Protobuf-Java) (7.4.0-7.4.2, 7.5.0)
Oracle Construction and Engineering / Admin (Google Protobuf-Java) (18.8.0-18.8.15, 19.12.0-19.12.15, 20.12.0-20.12.10, 21.12.0-21.12.8)
Oracle Financial Services Applications / Studio (Google Protobuf-Java) (8.0.8.3.1)
Oracle Fusion Middleware / Install (Google Protobuf-Java) (12.2.1.4.0)
Oracle MySQL / Connector/Net (Google Protobuf-Java) (8.0.31 and prior)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Communications Configuration (Google Protobuf-Java) 22.3.0 22.3.0
Oracle Communications Core (Google Protobuf-Java) 6.1.1-7.0.0 12.6.0.0.0
Oracle Communications Installation (Google Protobuf-Java) 22.3.2 22.3.2
Oracle Communications Platform (Google Protobuf-Java) 22.3.1 22.3.1
Oracle Communications Policy (Google Protobuf-Java) 22.3.0 22.3.0
Oracle Communications Signaling (Google Protobuf-Java) 22.2.2, 22.3.3 22.2.2 · 22.3.1 · 22.3.3
Oracle Communications Applications Core (Google Protobuf-Java) 5.5.0-5.5.9, 6.0.0-6.0.1
Oracle Communications Applications Policy (Google Protobuf-Java) 7.4.0-7.4.2, 7.5.0 7.5.0
Oracle Construction and Engineering Admin (Google Protobuf-Java) 18.8.0-18.8.15, 19.12.0-19.12.15, 20.12.0-20.12.10, 21.12.0-21.12.8
Oracle Financial Services Applications Accessibility (Google Protobuf-Java) 14.7.0.2.0, 14.7.1.0.0 14.7.0.2.0 · 14.7.1.0.0
Oracle Financial Services Applications Common (Google Protobuf-Java) 14.5.0.8.0, 14.6.0.4.0, 14.7.0.2.0, 14.7.1.0.0 14.5.0.8.0 · 14.6.0.4.0 · 14.7.0.2.0 · 14.7.1.0.0
Oracle Financial Services Applications Core (Google Protobuf-Java) 14.0-14.3, 14.5-14.7
Oracle Financial Services Applications Dashboard (Google Protobuf-Java) 14.5.0.8.0, 14.6.0.4.0, 14.7.0.2.0, 14.7.1.0.0 14.5.0.8.0 · 14.6.0.4.0 · 14.7.0.2.0 · 14.7.1.0.0
Oracle Financial Services Applications Infra Code (Google Protobuf-Java) 14.5, 14.6, 14.7 14.5 · 14.6 · 14.7
Oracle Financial Services Applications Infrastructure (Google Protobuf-Java) 14.0-14.3, 14.5-14.7 14.5 · 14.6 · 14.7
Oracle Financial Services Applications Security (Google Protobuf-Java) 2.9.0 2.9.0 · 14.7.0.2.0 · 14.7.1.0.0
Oracle Financial Services Applications Studio (Google Protobuf-Java) 8.0.8.3.1 8.0.8.3.1
Oracle Fusion Middleware Install (Google Protobuf-Java) 12.2.1.4.0 12.2.1.4.0
Oracle GoldenGate Veridata (Google Protobuf-Java) 12.2.1.4.0-12.2.1.4.230922
Oracle HealthCare Applications DataStudio (Google Protobuf-Java) 4.1.0, 4.1.1 4.1.0 · 4.1.1
Oracle MySQL Connector/Net (Google Protobuf-Java) 8.0.31 and prior
Oracle Retail Applications Internal Operations (Google Protobuf-Java) 18.0.0.12, 19.0.0.6 18.0.0.12 · 19.0.0.6
Oracle Siebel CRM Server Infrastructure (Apache ZooKeeper) 17.0-26.5

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
com.google.protobuf:protobuf-java 3.21.0-rc-1 3.21.7 unbounded
com.google.protobuf:protobuf-kotlin 3.21.0-rc-1 3.21.7 unbounded
com.google.protobuf:protobuf-javalite 3.21.0-rc-1 3.21.7 unbounded
com.google.protobuf:protobuf-kotlin-lite 3.21.0-rc-1 3.21.7 unbounded
com.google.protobuf:protobuf-java 3.20.0-rc-1 3.20.3 unbounded
com.google.protobuf:protobuf-java 3.17.0-rc-1 3.19.6 unbounded
com.google.protobuf:protobuf-java 0 3.16.3 unbounded
com.google.protobuf:protobuf-kotlin 3.20.0-rc-1 3.20.3 unbounded
com.google.protobuf:protobuf-kotlin 3.17.0-rc-1 3.19.6 unbounded
com.google.protobuf:protobuf-kotlin 0 3.16.3 unbounded
com.google.protobuf:protobuf-javalite 3.20.0-rc-1 3.20.3 unbounded
com.google.protobuf:protobuf-javalite 3.17.0-rc-1 3.19.6 unbounded
com.google.protobuf:protobuf-javalite 0 3.16.3 unbounded
com.google.protobuf:protobuf-kotlin-lite 3.20.0-rc-1 3.20.3 unbounded
com.google.protobuf:protobuf-kotlin-lite 3.17.0-rc-1 3.19.6 unbounded
com.google.protobuf:protobuf-kotlin-lite 0 3.16.3 unbounded

Products and versions

10 products, 37 version entries
SourceVendorProductSchemeAffected versions
osv com.google.protobuf protobuf-java generic ＜ 3.16.3 · ≥ 3.17.0 and ＜ 3.19.6 · ≥ 3.20.0 and ＜ 3.20.3 · ≥ 3.21.0 and ＜ 3.21.7
osv com.google.protobuf protobuf-javalite generic ＜ 3.16.3 · ≥ 3.17.0 and ＜ 3.19.6 · ≥ 3.20.0 and ＜ 3.20.3 · ≥ 3.21.0 and ＜ 3.21.7
osv com.google.protobuf protobuf-kotlin generic ＜ 3.16.3 · ≥ 3.17.0 and ＜ 3.19.6 · ≥ 3.20.0 and ＜ 3.20.3 · ≥ 3.21.0 and ＜ 3.21.7
osv com.google.protobuf protobuf-kotlin-lite generic ＜ 3.16.3 · ≥ 3.17.0 and ＜ 3.19.6 · ≥ 3.20.0 and ＜ 3.20.3 · ≥ 3.21.0 and ＜ 3.21.7
nvd fedoraproject fedora generic 37
nvd google google-protobuf generic ＜ 3.16.3 · ≥ 3.17.0 and ＜ 3.19.6 · ≥ 3.20.0 and ＜ 3.20.3 · ≥ 3.21.0 and ＜ 3.21.7
nvd google protobuf-java generic ＜ 3.16.3 · ≥ 3.17.0 and ＜ 3.19.6 · ≥ 3.20.0 and ＜ 3.20.3 · ≥ 3.21.0 and ＜ 3.21.7
nvd google protobuf-javalite generic ＜ 3.16.3 · ≥ 3.17.0 and ＜ 3.19.6 · ≥ 3.20.0 and ＜ 3.20.3 · ≥ 3.21.0 and ＜ 3.21.7
nvd google protobuf-kotlin generic ＜ 3.16.3 · ≥ 3.17.0 and ＜ 3.19.6 · ≥ 3.20.0 and ＜ 3.20.3 · ≥ 3.21.0 and ＜ 3.21.7
nvd google protobuf-kotlin-lite generic ＜ 3.16.3 · ≥ 3.17.0 and ＜ 3.19.6 · ≥ 3.20.0 and ＜ 3.20.3 · ≥ 3.21.0 and ＜ 3.21.7

References

URLTags
https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-h4h5-3hr4-j3g2 WEB
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48771 WEB
https://github.com/protocolbuffers/protobuf PACKAGE
https://github.com/protocolbuffers/protobuf/releases/tag/v21.7 WEB
https://github.com/protocolbuffers/protobuf/releases/tag/v3.16.3 WEB
https://github.com/protocolbuffers/protobuf/releases/tag/v3.19.6 WEB
https://github.com/protocolbuffers/protobuf/releases/tag/v3.20.3 WEB
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/google-protobuf/CVE-2022-3171.yml WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CBAUKJQL6O4TIWYBENORSY5P43TVB4M3 WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MPCGUT3T5L6C3IDWUPSUO22QDCGQKTOP WEB

Timeline
Published2022-10-12By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.