5.7

CVSS Score

3.1

-

CVSS Score

Basic Information

CVE ID

CVE-2022-3171

GHSA ID

GHSA-h4h5-3hr4-j3g2

EPSS Score

0.22366%

CWE

CWE-20

Published

10/4/2022

Updated

4/27/2023

KEV Status

Technology

Java

Basic Information

CVE ID

GHSA ID

EPSS Score

CWE

Published

Updated

KEV Status

Technology

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2022-3171

CVE-2022-3171: protobuf-java has a potential Denial of Service issue

Summary

A potential Denial of Service issue in protobuf-java core and lite was discovered in the parsing procedure for binary and text format data. Input streams containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses.

Reporter: OSS Fuzz

Affected versions: This issue affects both the Java full and lite Protobuf runtimes, as well as Protobuf for Kotlin and JRuby, which themselves use the Java Protobuf runtime.

Severity

CVE-2022-3171 Medium - CVSS Score: 5.7 (NOTE: there may be a delay in publication)

Remediation and Mitigation

Please update to the latest available versions of the following packages:

protobuf-java (3.21.7, 3.20.3, 3.19.6, 3.16.3) protobuf-javalite (3.21.7, 3.20.3, 3.19.6, 3.16.3) protobuf-kotlin (3.21.7, 3.20.3, 3.19.6, 3.16.3) protobuf-kotlin-lite (3.21.7, 3.20.3, 3.19.6, 3.16.3) google-protobuf [JRuby gem only] (3.21.7, 3.20.3, 3.19.6)

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2022-3171

CVE-2022-3171:

5.7

CVSS Score

3.1

-

CVSS Score

Basic Information

CVE ID

CVE-2022-3171

GHSA ID

GHSA-h4h5-3hr4-j3g2

EPSS Score

0.22366%

CWE

CWE-20

Published

10/4/2022

Updated

4/27/2023

KEV Status

Technology

Java

Basic Information

CVE ID

GHSA ID

EPSS Score

CWE

Published

Updated

KEV Status

Technology

Technical Details

CVSS Vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.google.protobuf:protobuf-java	maven	>= 3.21.0-rc-1, < 3.21.7	3.21.7
com.google.protobuf:protobuf-kotlin	maven	>= 3.21.0-rc-1, < 3.21.7	3.21.7
google-protobuf	rubygems	>= 3.21.0.rc.1, < 3.21.7	3.21.7
com.google.protobuf:protobuf-javalite	maven	>= 3.21.0-rc-1, < 3.21.7	3.21.7
com.google.protobuf:protobuf-kotlin-lite	maven	>= 3.21.0-rc-1, < 3.21.7	3.21.7
com.google.protobuf:protobuf-java	maven	>= 3.20.0-rc-1, < 3.20.3	3.20.3
com.google.protobuf:protobuf-java	maven	>= 3.17.0-rc-1, < 3.19.6	3.19.6
com.google.protobuf:protobuf-java	maven	< 3.16.3	3.16.3
com.google.protobuf:protobuf-kotlin	maven	>= 3.20.0-rc-1, < 3.20.3	3.20.3
com.google.protobuf:protobuf-kotlin	maven	>= 3.17.0-rc-1, < 3.19.6	3.19.6
com.google.protobuf:protobuf-kotlin	maven	< 3.16.3	3.16.3
google-protobuf	rubygems	>= 3.20.0.rc.1, < 3.20.3	3.20.3
google-protobuf	rubygems	>= 3.17.0.rc.1, < 3.19.6	3.19.6
google-protobuf	rubygems	< 3.16.3	3.16.3
com.google.protobuf:protobuf-javalite	maven	>= 3.20.0-rc-1, < 3.20.3	3.20.3
com.google.protobuf:protobuf-javalite	maven	>= 3.17.0-rc-1, < 3.19.6	3.19.6
com.google.protobuf:protobuf-javalite	maven	< 3.16.3	3.16.3
com.google.protobuf:protobuf-kotlin-lite	maven	>= 3.20.0-rc-1, < 3.20.3	3.20.3
com.google.protobuf:protobuf-kotlin-lite	maven	>= 3.17.0-rc-1, < 3.19.6	3.19.6
com.google.protobuf:protobuf-kotlin-lite	maven	< 3.16.3	3.16.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability stems from inefficient parsing logic that created excessive object conversions between mutable/immutable forms. Release notes specifically mention:

Migration of parsing from constructors to Builder classes
Changes in Lite runtime merging behavior
TextFormat parser optimizations These functions are central to message parsing and merging operations. The patch focused on reducing allocations by reusing builders instead of creating new immutable instances, directly addressing the GC pressure issue caused by repeated conversions.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

5.7

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2022-3171: protobuf-java has a potential Denial of Service issue

Summary

Severity

Remediation and Mitigation

CVE-2022-3171:

5.7

-

Basic Information

Basic Information

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability Intelligence
Miggo AI

Detect and Respond To Threats Faster.

Technical Details

5.7

5.7

Basic Information

Basic Information

CVE-2022-3171: protobuf-java has a potential Denial of Service issue

Summary

Severity

Remediation and Mitigation

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

5.7

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2022-3171: protobuf-java has a potential Denial of Service issue

Summary

Severity

Remediation and Mitigation

CVE-2022-3171:

5.7

-

Basic Information

Basic Information

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Technical Details

5.7

5.7

Basic Information

Basic Information

CVE-2022-3171: protobuf-java has a potential Denial of Service issue

Summary

Severity

Remediation and Mitigation

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI