CVE-2021-22569: Denial of Service of protobuf-java parsing procedure

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-01-10 · updated 2026-06-17
Weakness: CWE-696

Description

An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated pauses. We recommend upgrading libraries beyond the vulnerable versions.

Affected products

Google-Protobuf: before 3.19.2 — fixed in 3.19.2
Google protobuf-java: before 3.16.1; from 3.18.0 before 3.18.2; from 3.19.0 before 3.19.2 — fixed in 3.16.1, 3.18.2, 3.19.2
Google protobuf-kotlin: before 3.18.2; from 3.19.0 before 3.19.2 — fixed in 3.18.2, 3.19.2
Oracle Communications Cloud Native Core Console: 1.9.0
Oracle Communications Cloud Native Core Network Repository Function: 1.15.0, 1.15.1
Oracle Communications Cloud Native Core Policy: 1.15.0
Oracle Spatial And Graph Mapviewer: 19c, 21c

How to fix

Upgrade to a fixed version: Google-Protobuf 3.19.2; Google protobuf-java 3.16.1, 3.18.2, 3.19.2; Google protobuf-kotlin 3.18.2, 3.19.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-22569 or the next vulnerability affects your stack