CVE-2022-3171: Fedoraproject Fedora

High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days.

A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.

Affected products

• Fedoraproject Fedora: version 37 only
• Google Google-Protobuf: before 3.16.3 (fixed in 3.16.3); from 3.17.0, before 3.19.6 (fixed in 3.19.6); from 3.20.0, before 3.20.3 (fixed in 3.20.3); from 3.21.0, before 3.21.7 (fixed in 3.21.7)
• Google Protobuf-Java: before 3.16.3 (fixed in 3.16.3); from 3.17.0, before 3.19.6 (fixed in 3.19.6); from 3.20.0, before 3.20.3 (fixed in 3.20.3); from 3.21.0, before 3.21.7 (fixed in 3.21.7)
• Google Protobuf-Javalite: before 3.16.3 (fixed in 3.16.3); from 3.17.0, before 3.19.6 (fixed in 3.19.6); from 3.20.0, before 3.20.3 (fixed in 3.20.3); from 3.21.0, before 3.21.7 (fixed in 3.21.7)
• Google Protobuf-Kotlin: before 3.16.3 (fixed in 3.16.3); from 3.17.0, before 3.19.6 (fixed in 3.19.6); from 3.20.0, before 3.20.3 (fixed in 3.20.3); from 3.21.0, before 3.21.7 (fixed in 3.21.7)
• Google Protobuf-Kotlin-Lite: before 3.16.3 (fixed in 3.16.3); from 3.17.0, before 3.19.6 (fixed in 3.19.6); from 3.20.0, before 3.20.3 (fixed in 3.20.3); from 3.21.0, before 3.21.7 (fixed in 3.21.7)

Published 2022-10-12. Last modified 2026-06-17.