CVE-2021-22569
- Source
- https://cve.org/CVERecord?id=CVE-2021-22569
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-22569.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2021-22569
- Aliases
- Downstream
- Related
- Published
- 2022-01-10T14:10:16.747Z
- Modified
- 2026-04-02T06:50:52.980791Z
- Severity
-
- 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated pauses. We recommend upgrading libraries beyond the vulnerable versions.
- References
-
- https://lists.debian.org/debian-lts-announce/2023/04/msg00019.html
- https://cloud.google.com/support/bulletins#gcp-2022-001
- http://www.openwall.com/lists/oss-security/2022/01/12/4
- http://www.openwall.com/lists/oss-security/2022/01/12/7
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39330
- https://www.oracle.com/security-alerts/cpuapr2022.html
Affected packages
Git / github.com/protocolbuffers/protobuf
Affected ranges
- Type
- GIT
- Repo
- https://github.com/protocolbuffers/protobuf
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedIntroduced0 Unknown introduced commit / All previous commits are affectedFixedIntroducedFixedIntroducedFixedIntroduced0 Unknown introduced commit / All previous commits are affectedFixedIntroducedFixedIntroduced0 Unknown introduced commit / All previous commits are affectedLast affectedIntroduced0 Unknown introduced commit / All previous commits are affectedLast affected
- Database specific
{ "versions": [ { "introduced": "0" }, { "fixed": "3.19.2" }, { "introduced": "0" }, { "fixed": "3.16.1" }, { "introduced": "3.18.0" }, { "fixed": "3.18.2" }, { "introduced": "3.19.0" }, { "fixed": "3.19.2" }, { "introduced": "0" }, { "fixed": "3.18.2" }, { "introduced": "3.19.0" }, { "fixed": "3.19.2" }, { "introduced": "0" }, { "last_affected": "19c" }, { "introduced": "0" }, { "last_affected": "21c" } ] }
Affected versions
3.*
3.15.0-rc1
Other
conformance-build-tag
v2.*
v2.4.1
v2.5.0
v2.6.0
v2.6.1
v2.6.1rc1
v3.*
v3.0.0
v3.0.0-alpha-1
v3.0.0-alpha-2
v3.0.0-alpha-3
v3.0.0-alpha-3.1
v3.0.0-alpha-4
v3.0.0-alpha-4.1
v3.0.0-beta-1
v3.0.0-beta-1-bzl-fix
v3.0.0-beta-1.1
v3.0.0-beta-2
v3.0.0-beta-3
v3.0.0-beta-3-pre-1
v3.0.0-beta-3.1
v3.0.0-beta-3.2
v3.0.0-beta-3.3
v3.0.0-beta-4
v3.0.0-javalite
v3.0.1-javalite
v3.0.2
v3.1.0
v3.1.0-alpha-1
v3.10.0
v3.10.0-rc1
v3.10.1
v3.11.0
v3.11.0-rc1
v3.11.0-rc2
v3.11.1
v3.11.2
v3.11.3
v3.11.4
v3.12.0
v3.12.0-rc1
v3.12.0-rc2
v3.12.1
v3.12.2
v3.12.3
v3.12.4
v3.13.0
v3.13.0-rc3
v3.13.0.1
v3.14.0
v3.14.0-rc1
v3.14.0-rc2
v3.14.0-rc3
v3.15.0
v3.15.0-rc1
v3.15.0-rc2
v3.15.1
v3.15.2
v3.15.3
v3.15.4
v3.15.5
v3.15.6
v3.15.7
v3.15.8
v3.16.0
v3.16.0-rc1
v3.16.0-rc2
v3.17.0
v3.17.0-rc1
v3.17.0-rc2
v3.17.1
v3.17.2
v3.17.3
v3.18.0
v3.18.0-rc1
v3.18.0-rc2
v3.18.1
v3.19.0
v3.19.0-rc1
v3.19.0-rc2
v3.19.1
v3.2.0
v3.2.0-alpha-1
v3.2.0-rc.1
v3.2.0rc2
v3.2.1
v3.3.0
v3.3.0rc1
v3.3.1
v3.3.2
v3.4.0
v3.4.0rc1
v3.4.0rc2
v3.4.0rc3
v3.4.1
v3.5.0
v3.5.0.1
v3.5.1
v3.5.1.1
v3.5.2
v3.6.0
v3.6.0.1
v3.6.0rc1
v3.6.0rc2
v3.6.1
v3.6.1.1
v3.6.1.2
v3.6.1.3
v3.7.0
v3.7.0-rc.2
v3.7.0-rc.3
v3.7.0rc1
v3.7.0rc2
v3.7.1
v3.8.0
v3.8.0-rc1
v3.9.0
v3.9.0-rc1
v3.9.1
v3.9.2
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-22569.json"
unresolved_ranges
[
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.9.0"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.15.0"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.15.1"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.15.0"
}
]
}
]
vanir_signatures
[
{
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"328459828297406866746685094975132074155",
"320482912142515080020906968928056412245",
"94902428441466243207974400648954766131",
"139512282090018918949412744829553419206"
],
"threshold": 0.9
},
"source": "https://github.com/protocolbuffers/protobuf/commit/791a4355c365bd92720160671a7491be168055cb",
"id": "CVE-2021-22569-007a6f1a",
"target": {
"file": "src/google/protobuf/source_context.pb.h"
}
},
{
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"328459828297406866746685094975132074155",
"320482912142515080020906968928056412245",
"94902428441466243207974400648954766131",
"139512282090018918949412744829553419206"
],
"threshold": 0.9
},
"source": "https://github.com/protocolbuffers/protobuf/commit/791a4355c365bd92720160671a7491be168055cb",
"id": "CVE-2021-22569-0c6a5439",
"target": {
"file": "src/google/protobuf/any.pb.h"
}
},
{
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"328459828297406866746685094975132074155",
"320482912142515080020906968928056412245",
"94902428441466243207974400648954766131",
"139512282090018918949412744829553419206"
],
"threshold": 0.9
},
"source": "https://github.com/protocolbuffers/protobuf/commit/791a4355c365bd92720160671a7491be168055cb",
"id": "CVE-2021-22569-297c786b",
"target": {
"file": "src/google/protobuf/compiler/plugin.pb.h"
}
},
{
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"328459828297406866746685094975132074155",
"320482912142515080020906968928056412245",
"94902428441466243207974400648954766131",
"139512282090018918949412744829553419206"
],
"threshold": 0.9
},
"source": "https://github.com/protocolbuffers/protobuf/commit/791a4355c365bd92720160671a7491be168055cb",
"id": "CVE-2021-22569-2ad1978c",
"target": {
"file": "src/google/protobuf/field_mask.pb.h"
}
},
{
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"328459828297406866746685094975132074155",
"320482912142515080020906968928056412245",
"94902428441466243207974400648954766131",
"139512282090018918949412744829553419206"
],
"threshold": 0.9
},
"source": "https://github.com/protocolbuffers/protobuf/commit/791a4355c365bd92720160671a7491be168055cb",
"id": "CVE-2021-22569-74dbca6c",
"target": {
"file": "src/google/protobuf/type.pb.h"
}
},
{
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"328459828297406866746685094975132074155",
"320482912142515080020906968928056412245",
"94902428441466243207974400648954766131",
"139512282090018918949412744829553419206"
],
"threshold": 0.9
},
"source": "https://github.com/protocolbuffers/protobuf/commit/791a4355c365bd92720160671a7491be168055cb",
"id": "CVE-2021-22569-7d3abc12",
"target": {
"file": "src/google/protobuf/descriptor.pb.h"
}
},
{
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"328459828297406866746685094975132074155",
"320482912142515080020906968928056412245",
"94902428441466243207974400648954766131",
"139512282090018918949412744829553419206"
],
"threshold": 0.9
},
"source": "https://github.com/protocolbuffers/protobuf/commit/791a4355c365bd92720160671a7491be168055cb",
"id": "CVE-2021-22569-a55a1d2a",
"target": {
"file": "src/google/protobuf/wrappers.pb.h"
}
},
{
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"328459828297406866746685094975132074155",
"320482912142515080020906968928056412245",
"94902428441466243207974400648954766131",
"139512282090018918949412744829553419206"
],
"threshold": 0.9
},
"source": "https://github.com/protocolbuffers/protobuf/commit/791a4355c365bd92720160671a7491be168055cb",
"id": "CVE-2021-22569-cbf5b140",
"target": {
"file": "src/google/protobuf/timestamp.pb.h"
}
},
{
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"328459828297406866746685094975132074155",
"320482912142515080020906968928056412245",
"94902428441466243207974400648954766131",
"139512282090018918949412744829553419206"
],
"threshold": 0.9
},
"source": "https://github.com/protocolbuffers/protobuf/commit/791a4355c365bd92720160671a7491be168055cb",
"id": "CVE-2021-22569-d147c29a",
"target": {
"file": "src/google/protobuf/api.pb.h"
}
},
{
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"328459828297406866746685094975132074155",
"320482912142515080020906968928056412245",
"94902428441466243207974400648954766131",
"139512282090018918949412744829553419206"
],
"threshold": 0.9
},
"source": "https://github.com/protocolbuffers/protobuf/commit/791a4355c365bd92720160671a7491be168055cb",
"id": "CVE-2021-22569-dec320e6",
"target": {
"file": "src/google/protobuf/empty.pb.h"
}
},
{
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"328459828297406866746685094975132074155",
"320482912142515080020906968928056412245",
"94902428441466243207974400648954766131",
"139512282090018918949412744829553419206"
],
"threshold": 0.9
},
"source": "https://github.com/protocolbuffers/protobuf/commit/791a4355c365bd92720160671a7491be168055cb",
"id": "CVE-2021-22569-f87ca39e",
"target": {
"file": "src/google/protobuf/duration.pb.h"
}
},
{
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"328459828297406866746685094975132074155",
"320482912142515080020906968928056412245",
"94902428441466243207974400648954766131",
"139512282090018918949412744829553419206"
],
"threshold": 0.9
},
"source": "https://github.com/protocolbuffers/protobuf/commit/791a4355c365bd92720160671a7491be168055cb",
"id": "CVE-2021-22569-ff862195",
"target": {
"file": "src/google/protobuf/struct.pb.h"
}
}
]