7.5
High
CVE-2021-22569 An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that…
Description
An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated pauses. We recommend upgrading libraries beyond the vulnerable versions.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| protobuf-java 3.19 | earliest → < 3.19.2 | 3.19.2 |
| protobuf-java 3.18 | earliest → < 3.18.2 | 3.18.2 |
| protobuf-java 3.16 | earliest → < 3.16.1 | 3.16.1 |
| protobuf-kotlin 3.19 | earliest → < 3.19.2 | 3.19.2 |
| protobuf-kotlin 3.18 | earliest → < 3.18.2 | 3.18.2 |
| google-protobuf [JRuby Gem] 3.19 | earliest → < 3.19.2 | 3.19.2 |