← Vulnerability feed

Vulnerability record · CVE-2022-3510 · published 12 December 2022

CVE-2022-3510: Google protobuf-java uncontrolled resource consumption vulnerability

Google · Protobuf Java

A parsing issue similar to CVE-2022-3171, but with Message-Type Extensions in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.

7.5 CVSS 3.1 High EPSS 0.71% · top 48.2% CWE-400 · Uncontrolled resource consumption
7.5CVSS 3.1 base score
0.71%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

A parsing issue similar to CVE-2022-3171, but with Message-Type Extensions in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/protocolbuffers/protobuf/commit/db7c17803320525722f45c1d26fc08bc41d1bf48 PatchThird Party Advisory
https://github.com/protocolbuffers/protobuf/commit/db7c17803320525722f45c1d26fc08bc41d1bf48 PatchThird Party Advisory

Track CVE-2022-3510 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.7CVE-2024-7254Google protobuf uncontrolled resource consumption vulnerabilityAny project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exce…EPSS 2.8%7.5CVE-2022-3509Google protobuf-java uncontrolled resource consumption vulnerabilityA parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can …EPSS 0.95%7.5CVE-2022-3171Google-protobuf improper input validation vulnerabilityA parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service a…EPSS 1.1%5.5CVE-2021-22569Google-protobuf vulnerabilityAn issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. …EPSS 1.7%

Source: NIST National Vulnerability Database (record CVE-2022-3510), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.