Google Google-Protobuf vulnerabilities

2 CVEs affecting Google Google-Protobuf, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-3171, published 2022-10-12.

More from Google.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2021-22569, published 2022-01-10. Medium severity, CVSS 5.5. EPSS: 1.7% chance of exploitation in the next 30 days. An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser…
• CVE-2022-3171, published 2022-10-12. High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days. A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of…