Denial of Service Vulnerability in Protobuf Package: CVE-2022-3171
Summary
CVE-2022-3171: A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Affects protobuf versions < b8c2488f480bbe3d66b9874c2fcd434201caa48a. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Protobuf, or Protocol Buffers, is a language-agnostic binary serialization format developed by Google. It is widely used for data interchange in various applications due to its efficiency and ease of use. The package is known for its ability to serialize structured data, making it a popular choice in microservices and APIs. However, certain versions of the Protobuf package are vulnerable to a denial of service attack due to a parsing issue with binary data.
Vulnerability Detail
CVE-2022-3171 is a vulnerability found in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6, and 3.16.3. The vulnerability arises from a parsing issue where inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields can lead to excessive garbage collection pauses. This can result in a denial of service, as the application may become unresponsive during these long pauses. The vulnerability is particularly concerning for applications that rely on real-time data processing.
How To Fix
No fixed version is published for this vulnerability.
To fix the vulnerability, update the Protobuf package to one of the following versions: 3.21.7, 3.20.3, 3.19.6, or 3.16.3. For Debian users, you can execute the following commands in your terminal:
- Update the package list:
sudo apt update
- Upgrade the protobuf package:
sudo apt install protobuf=3.21.9-3
Make sure to verify the installed version using: dpkg -l | grep protobuf
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation to restrict the types of messages processed by your application. This can help mitigate the risk of triggering the vulnerability until a proper fix is applied.
Conclusion
CVE-2022-3171 represents a significant denial of service vulnerability in the Protobuf package, affecting various versions. It is crucial for users to upgrade to the specified versions to mitigate the risk. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for protobuf →
FAQ
CVE-2022-3171 is a vulnerability in the Protobuf package that can lead to denial of service due to excessive garbage collection pauses caused by specific binary data inputs.
The affected versions are those prior to 3.21.7, 3.20.3, 3.19.6, and 3.16.3.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score for CVE-2022-3171 is 7.5, indicating a high severity level.
If you cannot upgrade, implement input validation to restrict the types of messages processed by your application as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for protobuf.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.