CVE-2021-22569: Google Google-Protobuf

Medium severity, CVSS 5.5. EPSS: 1.7% chance of exploitation in the next 30 days.

An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated pauses. We recommend upgrading libraries beyond the vulnerable versions.

Affected products

• Google Google-Protobuf: before 3.19.2 (fixed in 3.19.2)
• Google Protobuf-Java: before 3.16.1 (fixed in 3.16.1); from 3.18.0, before 3.18.2 (fixed in 3.18.2); from 3.19.0, before 3.19.2 (fixed in 3.19.2)
• Google Protobuf-Kotlin: before 3.18.2 (fixed in 3.18.2); from 3.19.0, before 3.19.2 (fixed in 3.19.2)
• Oracle Communications Cloud Native Core Console: version 1.9.0 only
• Oracle Communications Cloud Native Core Network Repository Function: version 1.15.0 only; version 1.15.1 only
• Oracle Communications Cloud Native Core Policy: version 1.15.0 only
• Oracle Spatial And Graph Mapviewer: version 19c only; version 21c only

Published 2022-01-10. Last modified 2026-06-17.