Denial of Service Vulnerability in Protobuf Package: CVE-2022-3509
Summary
CVE-2022-3509: A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Affects protobuf versions < a3888f53317a8018e7a439bac4abeb8f3425d5e9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Protobuf package, also known as Protocol Buffers, is a language-agnostic binary serialization format developed by Google. It is widely used for data interchange between services and applications due to its efficiency and compactness. However, certain versions of Protobuf are vulnerable to a parsing issue that can lead to denial of service attacks, particularly when handling specific types of input.
Vulnerability Detail
CVE-2022-3509 is a parsing vulnerability found in the core and lite versions of protobuf-java prior to versions 3.21.7, 3.20.3, 3.19.6, and 3.16.3. The issue arises when inputs contain multiple instances of non-repeated embedded messages with repeated or unknown fields. This can cause objects to be converted back and forth between mutable and immutable forms, leading to potentially long garbage collection pauses. The vulnerability can be exploited to disrupt service availability, making it critical to address.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation to restrict the types of messages processed by your application. This can help mitigate the risk of triggering the vulnerability until a proper update can be applied.
Conclusion
CVE-2022-3509 presents a significant risk to applications using vulnerable versions of the Protobuf package. It is crucial to update to the recommended versions to mitigate the risk of denial of service attacks. Implementing input validation can serve as a temporary measure until the update is applied.
See every vulnerability recorded for protobuf →
FAQ
CVE-2022-3509 is a denial of service vulnerability in the Protobuf package that can be exploited through specific input patterns.
The vulnerability affects protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6, and 3.16.3.
Exploitation of this vulnerability can lead to long garbage collection pauses, resulting in service disruptions and denial of service.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check your application without signup.
The CVSS score for CVE-2022-3509 is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for protobuf.
