CVE-2021-22569

Description

An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated pauses. We recommend upgrading libraries beyond the vulnerable versions.

Weakness classification

• cve-coordination@google.com: CWE-696
• nvd@nist.gov: NVD-CWE-noinfo

Primary references

• cve-coordination@google.com — Mailing List, Third Party Advisory
• cve-coordination@google.com — Mailing List, Third Party Advisory
• cve-coordination@google.com — Exploit, Issue Tracking, Mailing List, Vendor Advisory
• cve-coordination@google.com — Vendor Advisory
• cve-coordination@google.com
• cve-coordination@google.com — Patch, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Issue Tracking, Mailing List, Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108
• af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory