CVE-2022-3510

Name of the Vulnerable Software and Affected Versions protobuf-java versions prior to 3.21.7 protobuf-java versions prior to 3.20.3 protobuf-java versions prior to 3.19.6 protobuf-java versions prior to 3.16.3

Description The issue is related to insufficient input validation in the Java Protocol Buffers library, which can lead to a denial of service attack. Specifically, inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields cause objects to be converted back and forth between mutable and immutable forms, resulting in potentially long garbage collection pauses.

Recommendations Update to version 3.21.7 or later. Update to version 3.20.3 or later. Update to version 3.19.6 or later. Update to version 3.16.3 or later.