high 7.5

CVE-2021-22569 json

Denial of Service of protobuf-java parsing procedure

published 2022-01-07 4 y ago modified 2026-09-10 1 mo ago also GHSA-wrvw-hg22-4m67 , EUVD-2022-0729

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.8%; EPSS 1.8% chance of exploitation in 30 days, percentile 78%
public exploits: 0; none known

An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated pauses. We recommend upgrading libraries beyond the vulnerable versions.

Patch / fix

fixed in 6 distros 4 links 1

maven com.google.protobuf:protobuf-java 3.16.1, 3.18.2, 3.19.2
rubygems google-protobuf 3.19.2
maven com.google.protobuf:protobuf-kotlin 3.18.2, 3.19.2
Google LLC protobuf-java 3.16.1, 3.18.2, 3.19.2
Google LLC protobuf-kotlin 3.18.2, 3.19.2
Google LLC google-protobuf [JRuby Gem] 3.19.2

debian ubuntu suse azure linux

protobuf Debian 14, Debian 13, Debian 12 3.21.9-3

debian advisories DEBIAN-CVE-2021-22569

protobuf Ubuntu 18.04 LTS 3.0.0-9.1ubuntu1.1
protobuf Ubuntu 20.04 LTS 3.6.1.3-2ubuntu5.2
protobuf Ubuntu 22.04 LTS 3.12.4-1ubuntu7.22.04.1
protobuf Ubuntu Pro 14.04 LTS 2.5.0-9ubuntu1+esm1

ubuntu advisories UBUNTU-CVE-2021-22569

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

protobuf SLE Module for Public Cloud 15 SP1, SLE Installer Updates 15 SP1, SLES for SAP 15 SP1 +2 more 3.9.2-150100.8.3.3
python-psutil SLE Module for Public Cloud 15 SP1, Enterprise Storage 7, SLES for SAP 15 SP2 +5 more 5.9.1-150100.6.6.3
python-requests SLE Module for Public Cloud 15 SP1, Enterprise Storage 7, SLES for SAP 15 SP2 +5 more 2.25.1-150100.6.13.3
grpc SLE Module for Public Cloud 15 SP1 1.25.0-150100.3.3.3
python-avro SLE Module for Public Cloud 15 SP4, SLE Module for Public Cloud 15 SP3, SLE Module for Public Cloud 15 SP2 +1 more 1.11.0-150100.3.3.3
python-knack SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4, SLE Module for Public Cloud 15 SP3 +3 more 0.9.0-150100.3.7.3
python-pytest SLE Module for Public Cloud 15 SP2, SLE Module for Public Cloud 15 SP1 3.10.1-150000.7.5.1
azure-cli-core SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4, SLE Module for Public Cloud 15 SP3 +3 more 2.17.1-150100.6.18.1

suse advisories SUSE-SU-2023:2783-2 SUSE-SU-2023:2783-1 SUSE-SU-2022:3922-1

pytorch Azure Linux 3.0 2.2.2-5

azure linux advisories AZL-41431

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

oracle.com/security-alerts/cpuapr2022.html advisory

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-22569 updated 2026-11-05 cvss 5.5

protobuf-java: potential DoS in the parsing procedure for binary data

Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/elasticsearch6-rhel8
affected: no fix planned “Will not fix”
Red Hat BPM Suite 6 protobuf-java
affected: no fix planned “Out of support scope”
Red Hat build of Debezium 1 protobuf-java Red Hat Integration Camel K 1 protobuf-java
affected: no fix available
Red Hat Integration Camel Quarkus 1 protobuf-java
affected: no fix planned “Will not fix”
Red Hat Integration Service Registry protobuf-java
affected: no fix available
Red Hat JBoss BRMS 5 protobuf-java Red Hat JBoss BRMS 6 protobuf-java Red Hat JBoss Data Grid 6 protobuf-java Red Hat JBoss Data Grid 7 protobuf-java Red Hat JBoss Data Virtualization 6 protobuf-java Red Hat JBoss Fuse 6 protobuf-java

+2 more productsfewer

Red Hat JBoss Fuse Service Works 6 protobuf-java Red Hat JBoss SOA Platform 5 protobuf-java

affected: no fix planned “Out of support scope”
Red Hat OpenShift Container Platform 4 openshift4/ose-metering-hive, openshift4/ose-metering-hadoop, openshift4/ose-metering-presto
affected: no fix available “Fix deferred”
Red Hat Satellite 6 candlepin, candlepin-selinux
affected: no fix planned “Will not fix”

show 8 more

Red Hat build of Quarkus 2.7.5
fixed: vendor fix RHSA-2022:4623
Red Hat Fuse 7.11
fixed: vendor fix RHSA-2022:5532
Red Hat RHINT Camel-Q 2.2.1
fixed: vendor fix RHSA-2022:1013
Red Hat RHINT Debezium 1.9.7
fixed: vendor fix RHSA-2022:7896
Red Hat RHINT Service Registry 2.3.0 GA
fixed: vendor fix RHSA-2022:6835
Red Hat RHPAM 7.13.0 async
fixed: vendor fix RHSA-2022:5903
Red Hat Text-Only RHOAR
fixed: vendor fix RHSA-2022:8761
Red Hat JBoss Enterprise Application Platform 7 protobuf-java Red Hat JBoss Enterprise Application Platform Expansion Pack protobuf-java
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: Proof of concept is public
Automatable: yes
Technical impact: partial
Assessed: 18 mo ago (2025-04-21)

Exploit prediction

1.80% chance of exploitation in the next 30 days, higher than 78% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

bugs.chromium.org https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39330 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD	2.0	4.3	AV:N/AC:M/Au:N/C:N/I:N/A:P
GitHub	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
maven	com.google.protobuf:protobuf-java	<3.16.1 >=3.18.0, <3.18.2 >=3.19.0, <3.19.2	3.16.1 3.18.2 3.19.2
rubygems	google-protobuf	<3.19.2	3.19.2
maven	com.google.protobuf:protobuf-kotlin	>=3.18.0, <3.18.2 >=3.19.0, <3.19.2	3.18.2 3.19.2

Affected products

Google LLC protobuf-java
Google LLC protobuf-kotlin
Google LLC google-protobuf [JRuby Gem]

Classification

Weakness

CWE-696 Incorrect Behavior Order

References

oracle.com /security-alerts/cpuapr2022.html
web, patch, third-party-advisory
bugs.chromium.org /p/oss-fuzz/issues/detail?id=39330
web, exploit, issue-tracking, mailing-list, vendor-advisory
cloud.google.com /support/bulletins#gcp-2022-001
web, vendor-advisory
openwall.com /lists/oss-security/2022/01/12/4
mailing-list, web, third-party-advisory
openwall.com /lists/oss-security/2022/01/12/7
mailing-list, web, third-party-advisory
lists.debian.org /debian-lts-announce/2023/04/msg00019.html
mailing-list
github.com /protocolbuffers/protobuf/security/advisories/GHSA-wrvw-hg22-4m67
web
nvd.nist.gov /vuln/detail/CVE-2021-22569
advisory
github.com /protocolbuffers/protobuf
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary