Google Protobuf-Java vulnerabilities

5 CVEs affecting Google Protobuf-Java, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-7254, published 2024-09-19.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-7254, published 2024-09-19. High severity, CVSS 7.5. EPSS: 2.8% chance of exploitation in the next 30 days. Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing…
CVE-2021-22569, published 2022-01-10. Medium severity, CVSS 5.5. EPSS: 1.7% chance of exploitation in the next 30 days. An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser…
CVE-2022-3171, published 2022-10-12. High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days. A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of…
CVE-2022-3509, published 2022-12-12. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs…
CVE-2022-3510, published 2022-12-12. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. A parsing issue similar to CVE-2022-3171, but with Message-Type Extensions in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack.…