CVE-2022-3509

    Dashboard / Vulnerabilities / CVE-2022-3509

    CVE-2022-3509

    Published: 1 Nov 2022Last Modified: 12 Aug 2026

    Summary: Parsing issue in protobuf textformat

    Details: A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.

    References: https://github.com/protocolbuffers/protobuf/, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3509.json, https://nvd.nist.gov/vuln/detail/CVE-2022-3509, https://github.com/protocolbuffers/protobuf/commit/a3888f53317a8018e7a439bac4abeb8f3425d5e9

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 2dc747c574b68a808ea4699d26942c8132fe2b09
    Fixed -b8c2488f480bbe3d66b9874c2fcd434201caa48a

    Affected versions

    v3.20.1
    v3.20.1-rc1
    v3.20.0-rc3
    v3.20.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High