CVE-2022-3509
Parsing issue in protobuf textformat
A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Parsing issue in protobuf textformat
A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.
- Record
CVE-2022-3509- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2022-7625
A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.
- Record
EUVD-2022-7625- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-g5ww-5jh7-63cx
Protobuf Java vulnerable to Uncontrolled Resource Consumption
A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.
- Record
GHSA-g5ww-5jh7-63cx- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
NVD
A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.
- Record
CVE-2022-3509- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
Parsing issue in protobuf textformat
A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.
- Record
CVE-2022-3509- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-g5ww-5jh7-63cx
Protobuf Java vulnerable to Uncontrolled Resource Consumption
A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.
- Record
GHSA-g5ww-5jh7-63cx- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
Show 10 moreShow less
OSVROOT-APP-MAVEN-CVE-2022-3509
CVE-2022-3509 in com.google.protobuf:protobuf-java - Patched by Root
Root has patched CVE-2022-3509 in the com.google.protobuf:protobuf-java package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2022-3509- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-3509
A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.
- Record
UBUNTU-CVE-2022-3509- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1777250321 No score
TuxCare security update for com.google.protobuf (1 CVE)
TuxCare rebuilt 2 com.google.protobuf packages to address 1 CVE. Fixed in 3.21.1-tuxcare.2.
- Record
CLSA-2026-1777250321- Updated
- 2026-11-02
OSVCLSA-2026-1791960535 No score
TuxCare security update for com.google.protobuf:protobuf-java (1 CVE)
TuxCare rebuilt com.google.protobuf:protobuf-java to address 1 CVE. Fixed in 2.6.1-tuxcare.2.
- Record
CLSA-2026-1791960535- Updated
- 2026-11-02
OSVCLSA-2026-1791965654 No score
TuxCare security update for com.google.protobuf:protobuf-java (1 CVE)
TuxCare rebuilt com.google.protobuf:protobuf-java to address 1 CVE. Fixed in 2.5.0-tuxcare.2.
- Record
CLSA-2026-1791965654- Updated
- 2026-11-02
OSVCLSA-2026-1792049845 No score
TuxCare security update for com.google.protobuf (3 CVEs)
TuxCare rebuilt 2 com.google.protobuf packages to address 3 CVEs. Fixed in 3.12.0-tuxcare.1.
- Record
CLSA-2026-1792049845- Updated
- 2026-11-02
OSVCLSA-2026-1792049928 No score
TuxCare security update for com.google.protobuf (2 CVEs)
TuxCare rebuilt 2 com.google.protobuf packages to address 2 CVEs. Fixed in 3.16.1-tuxcare.1.
- Record
CLSA-2026-1792049928- Updated
- 2026-11-02
OSVCLSA-2026-1792050084 No score
TuxCare security update for com.google.protobuf (2 CVEs)
TuxCare rebuilt 4 com.google.protobuf packages to address 2 CVEs. Fixed in 3.19.2-tuxcare.1.
- Record
CLSA-2026-1792050084- Updated
- 2026-11-02
OSVCLSA-2026-1793122706 No score
TuxCare security update for com.google.protobuf (3 CVEs)
TuxCare rebuilt 2 com.google.protobuf packages to address 3 CVEs. Fixed in 3.12.2-tuxcare.1.
- Record
CLSA-2026-1793122706- Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-3509 No score
A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.
- Record
DEBIAN-CVE-2022-3509- Updated
- 2026-11-03
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.google.protobuf:protobuf-javaMaven |
3.17.0 up to 3.19.6 | 3.19.6 |
com.google.protobuf:protobuf-javaMaven |
3.20.0 up to 3.20.3 | 3.20.3 |
com.google.protobuf:protobuf-javaMaven |
3.21.0 up to 3.21.7 | 3.21.7 |
com.google.protobuf:protobuf-javaliteMaven |
3.20.0 up to 3.20.3 | 3.20.3 |
com.google.protobuf:protobuf-javaliteMaven |
3.21.0 up to 3.21.7 | 3.21.7 |
com.google.protobuf:protobuf-javaMaven |
3.0.0 up to 3.16.3 | 3.16.3 |
com.google.protobuf:protobuf-javaliteMaven |
3.0.0 up to 3.16.3 | 3.16.3 |
com.google.protobuf:protobuf-javaTuxCare:Maven |
3.21.1 up to 3.21.1-tuxcare.2, plus listed versions 3.21.1-tuxcare.1 |
3.21.1-tuxcare.2 |
com.google.protobuf:protobuf-javaliteTuxCare:Maven |
3.21.1 up to 3.21.1-tuxcare.2, plus listed versions 3.21.1-tuxcare.1 |
3.21.1-tuxcare.2 |
com.google.protobuf:protobuf-javaTuxCare:Maven |
2.6.1 up to 2.6.1-tuxcare.2, plus listed versions 2.6.1-tuxcare.1 |
2.6.1-tuxcare.2 |
Show 25 moreShow less
| Package | Affected | Fixed |
|---|---|---|
com.google.protobuf:protobuf-javaTuxCare:Maven |
2.5.0 up to 2.5.0-tuxcare.2, plus listed versions 2.5.0-tuxcare.1 |
2.5.0-tuxcare.2 |
com.google.protobuf:protobuf-javaTuxCare:Maven From an advisory covering 3 CVEs |
3.12.0 up to 3.12.0-tuxcare.1 | 3.12.0-tuxcare.1 |
com.google.protobuf:protobuf-javaliteTuxCare:Maven From an advisory covering 3 CVEs |
3.12.0 up to 3.12.0-tuxcare.1 | 3.12.0-tuxcare.1 |
com.google.protobuf:protobuf-javaTuxCare:Maven From an advisory covering 2 CVEs |
3.16.1 up to 3.16.1-tuxcare.1 | 3.16.1-tuxcare.1 |
com.google.protobuf:protobuf-javaliteTuxCare:Maven From an advisory covering 2 CVEs |
3.16.1 up to 3.16.1-tuxcare.1 | 3.16.1-tuxcare.1 |
com.google.protobuf:protobuf-javaTuxCare:Maven From an advisory covering 2 CVEs |
3.19.2 up to 3.19.2-tuxcare.1 | 3.19.2-tuxcare.1 |
com.google.protobuf:protobuf-javaliteTuxCare:Maven From an advisory covering 2 CVEs |
3.19.2 up to 3.19.2-tuxcare.1 | 3.19.2-tuxcare.1 |
com.google.protobuf:protobuf-kotlinTuxCare:Maven From an advisory covering 2 CVEs |
3.19.2 up to 3.19.2-tuxcare.1 | 3.19.2-tuxcare.1 |
com.google.protobuf:protobuf-kotlin-liteTuxCare:Maven From an advisory covering 2 CVEs |
3.19.2 up to 3.19.2-tuxcare.1 | 3.19.2-tuxcare.1 |
com.google.protobuf:protobuf-javaTuxCare:Maven From an advisory covering 3 CVEs |
3.12.2 up to 3.12.2-tuxcare.1 | 3.12.2-tuxcare.1 |
com.google.protobuf:protobuf-javaliteTuxCare:Maven From an advisory covering 3 CVEs |
3.12.2 up to 3.12.2-tuxcare.1 | 3.12.2-tuxcare.1 |
protobufDebian:12 |
before 3.21.9-3 | 3.21.9-3 |
protobufDebian:13 |
before 3.21.9-3 | 3.21.9-3 |
protobufDebian:14 |
before 3.21.9-3 | 3.21.9-3 |
com.google.protobuf:protobuf-javaMaven |
3.0.0 up to 3.16.3, plus listed versions 3.0.23.1.03.10.03.10.0-rc-13.11.0 Show 45 moreShow less3.11.0-rc-13.11.0-rc-23.11.13.11.33.11.43.12.03.12.0-rc-13.12.0-rc-23.12.13.12.23.12.43.13.03.13.0-rc-33.14.03.14.0-rc-13.14.0-rc-23.14.0-rc-33.15.03.15.0-rc-13.15.0-rc-23.15.13.15.23.15.33.15.43.15.53.15.63.15.73.15.83.16.03.16.0-rc-13.16.0-rc-23.16.13.2.03.2.0-rc.13.2.0rc23.3.03.3.13.4.03.5.03.5.13.6.03.6.13.7.03.7.0-rc13.7.1 |
3.16.3 |
com.google.protobuf:protobuf-javaMaven |
3.17.0 up to 3.19.6, plus listed versions 3.17.13.17.23.17.33.18.03.18.0-rc-1 Show 12 moreShow less3.18.0-rc-23.18.13.18.23.18.33.19.03.19.0-rc-13.19.0-rc-23.19.13.19.23.19.33.19.43.19.5 |
3.19.6 |
com.google.protobuf:protobuf-javaMaven |
3.20.0 up to 3.20.3, plus listed versions 3.20.13.20.1-rc-13.20.2 |
3.20.3 |
com.google.protobuf:protobuf-javaMaven |
3.21.0 up to 3.21.7, plus listed versions 3.21.13.21.23.21.33.21.43.21.53.21.6 |
3.21.7 |
com.google.protobuf:protobuf-javaliteMaven |
3.20.0 up to 3.20.3, plus listed versions 3.20.13.20.1-rc-13.20.2 |
3.20.3 |
com.google.protobuf:protobuf-javaliteMaven |
3.21.0 up to 3.21.7, plus listed versions 3.21.13.21.23.21.33.21.43.21.53.21.6 |
3.21.7 |
com.google.protobuf:protobuf-javaliteMaven |
3.0.0 up to 3.16.3, plus listed versions 3.10.03.10.0-rc-13.11.03.11.0-rc-13.11.0-rc-2 Show 36 moreShow less3.11.13.11.33.11.43.12.03.12.0-rc-13.12.0-rc-23.12.13.12.23.12.43.13.03.13.0-rc-33.14.03.14.0-rc-13.14.0-rc-23.14.0-rc-33.15.03.15.0-rc-13.15.0-rc-23.15.13.15.23.15.33.15.43.15.53.15.63.15.73.15.83.16.03.16.0-rc-13.16.0-rc-23.16.13.8.03.8.0-rc-13.9.03.9.0-rc-13.9.13.9.2 |
3.16.3 |
com.google.protobuf:protobuf-javaRoot:Maven |
before 3.5.1-aikido.1 | 3.5.1-aikido.13.21.1-aikido.13.19.3-aikido.13.21.1-aikido.23.19.3-aikido.23.5.1-aikido.23.21.7-aikido.13.21.7-aikido.2 |
io.root.com.google.protobuf:protobuf-javaRoot:Maven |
before 3.5.1-root.io.1 | 3.5.1-root.io.13.21.1-root.io.13.19.3-root.io.13.21.1-root.io.23.19.3-root.io.23.5.1-root.io.23.21.7-root.io.13.21.7-root.io.2 |
protobufUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 2.4.1-3ubuntu22.4.1-3ubuntu32.4.1-3ubuntu42.5.0-5ubuntu22.5.0-7ubuntu12.5.0-8ubuntu12.5.0-9ubuntu12.5.0-9ubuntu1+esm1 |
None known |
protobufUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.6.1-1.22.6.1-1.32.6.1-1.3ubuntu0.1~esm12.6.1-1.3ubuntu0.1~esm22.6.1-1.3ubuntu0.1~esm4 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | toluwanimidurosomo/CYB-401- | 2026-10-20 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-3509 is a high vulnerability (CVSS 7.5) in Google Protobuf-java, published November 1, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.97%, the 61st percentile. Fixed in com.google.protobuf:protobuf-java 3.19.6.
References
github.com/protocolbuffers/protobuf/commit/a3888f53317a8018e7a439bac4abeb8f3425d5e9
nvd.nist.gov/vuln/detail/CVE-2022-3509
Left out here: 6 versions. The JSON record has them.