CVE-2022-3510: Google Protobuf-Java

High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days.

A parsing issue similar to CVE-2022-3171, but with Message-Type Extensions in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.

Affected products

• Google Protobuf-Java: from 3.16.0, before 3.16.3 (fixed in 3.16.3); from 3.19.0, before 3.19.6 (fixed in 3.19.6); from 3.20.0, before 3.20.3 (fixed in 3.20.3); from 3.21.0, before 3.21.7 (fixed in 3.21.7)
• Google Protobuf-Javalite: from 3.16.0, before 3.16.3 (fixed in 3.16.3); from 3.17.0, before 3.19.6 (fixed in 3.19.6); from 3.20.0, before 3.20.3 (fixed in 3.20.3); from 3.21.0, before 3.21.7 (fixed in 3.21.7)

Published 2022-12-12. Last modified 2026-06-17.