{"id":"CVE-2022-3509","aliases":["CLSA-2026-1777250321","CLSA-2026-1791960535","CLSA-2026-1791965654","CLSA-2026-1792049845","CLSA-2026-1792049928","CLSA-2026-1792050084","CLSA-2026-1793122706","DEBIAN-CVE-2022-3509","EUVD-2022-7625","GHSA-g5ww-5jh7-63cx","ROOT-APP-MAVEN-CVE-2022-3509","UBUNTU-CVE-2022-3509"],"status":"published","title":"Parsing issue in protobuf textformat","description":"A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00967,"percentile":0.62025,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-400"],"published":"2022-11-01T18:09:31Z","modified":"2026-11-03T06:02:39Z","exploits":[{"source":"pocgithub","id":"toluwanimidurosomo/CYB-401-","title":"toluwanimidurosomo/CYB-401-","date":"2026-10-20","url":"https://github.com/toluwanimidurosomo/CYB-401-"}],"fixes":[{"ecosystem":"Maven","package":"com.google.protobuf:protobuf-java","fixed_in":["3.19.6","3.20.3","3.21.7","3.16.3"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"com.google.protobuf:protobuf-javalite","fixed_in":["3.20.3","3.21.7","3.16.3"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"com.google.protobuf:protobuf-java","fixed_in":["3.21.1-tuxcare.2","2.6.1-tuxcare.2","2.5.0-tuxcare.2"],"sources":["osv"]},{"ecosystem":"TuxCare:Maven","package":"com.google.protobuf:protobuf-javalite","fixed_in":["3.21.1-tuxcare.2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"protobuf","fixed_in":["3.21.9-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"protobuf","fixed_in":["3.21.9-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"protobuf","fixed_in":["3.21.9-3"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"com.google.protobuf:protobuf-java","fixed_in":["3.5.1-aikido.1","3.21.1-aikido.1","3.19.3-aikido.1","3.21.1-aikido.2","3.19.3-aikido.2","3.5.1-aikido.2","3.21.7-aikido.1","3.21.7-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.com.google.protobuf:protobuf-java","fixed_in":["3.5.1-root.io.1","3.21.1-root.io.1","3.19.3-root.io.1","3.21.1-root.io.2","3.19.3-root.io.2","3.5.1-root.io.2","3.21.7-root.io.1","3.21.7-root.io.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.google.protobuf:protobuf-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.17.0"},{"fixed":"3.19.6"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.google.protobuf:protobuf-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.20.0"},{"fixed":"3.20.3"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.google.protobuf:protobuf-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.21.0"},{"fixed":"3.21.7"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.google.protobuf:protobuf-javalite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.20.0"},{"fixed":"3.20.3"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.google.protobuf:protobuf-javalite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.21.0"},{"fixed":"3.21.7"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.google.protobuf:protobuf-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.16.3"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.google.protobuf:protobuf-javalite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.16.3"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.google.protobuf:protobuf-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.21.1"},{"fixed":"3.21.1-tuxcare.2"}]}],"versions":["3.21.1","3.21.1-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.google.protobuf:protobuf-javalite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.21.1"},{"fixed":"3.21.1-tuxcare.2"}]}],"versions":["3.21.1","3.21.1-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.google.protobuf:protobuf-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.1"},{"fixed":"2.6.1-tuxcare.2"}]}],"versions":["2.6.1","2.6.1-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.google.protobuf:protobuf-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.5.0-tuxcare.2"}]}],"versions":["2.5.0","2.5.0-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.google.protobuf:protobuf-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.0"},{"fixed":"3.12.0-tuxcare.1"}]}],"versions":["3.12.0"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.google.protobuf:protobuf-javalite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.0"},{"fixed":"3.12.0-tuxcare.1"}]}],"versions":["3.12.0"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.google.protobuf:protobuf-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.16.1"},{"fixed":"3.16.1-tuxcare.1"}]}],"versions":["3.16.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.google.protobuf:protobuf-javalite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.16.1"},{"fixed":"3.16.1-tuxcare.1"}]}],"versions":["3.16.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.google.protobuf:protobuf-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.19.2"},{"fixed":"3.19.2-tuxcare.1"}]}],"versions":["3.19.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.google.protobuf:protobuf-javalite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.19.2"},{"fixed":"3.19.2-tuxcare.1"}]}],"versions":["3.19.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.google.protobuf:protobuf-kotlin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.19.2"},{"fixed":"3.19.2-tuxcare.1"}]}],"versions":["3.19.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.google.protobuf:protobuf-kotlin-lite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.19.2"},{"fixed":"3.19.2-tuxcare.1"}]}],"versions":["3.19.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.google.protobuf:protobuf-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.2"},{"fixed":"3.12.2-tuxcare.1"}]}],"versions":["3.12.2"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.google.protobuf:protobuf-javalite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.2"},{"fixed":"3.12.2-tuxcare.1"}]}],"versions":["3.12.2"],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.9-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.9-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.9-3"}]}]},{"source":"osv","ecosystem":"Maven","package":"com.google.protobuf:protobuf-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.16.3"}]}],"versions":["3.0.0","3.0.2","3.1.0","3.10.0","3.10.0-rc-1","3.11.0","3.11.0-rc-1","3.11.0-rc-2","3.11.1","3.11.3","3.11.4","3.12.0","3.12.0-rc-1","3.12.0-rc-2","3.12.1","3.12.2","3.12.4","3.13.0","3.13.0-rc-3","3.14.0","3.14.0-rc-1","3.14.0-rc-2","3.14.0-rc-3","3.15.0","3.15.0-rc-1","3.15.0-rc-2","3.15.1","3.15.2","3.15.3","3.15.4","3.15.5","3.15.6","3.15.7","3.15.8","3.16.0","3.16.0-rc-1","3.16.0-rc-2","3.16.1","3.2.0","3.2.0-rc.1","3.2.0rc2","3.3.0","3.3.1","3.4.0","3.5.0","3.5.1","3.6.0","3.6.1","3.7.0","3.7.0-rc1","3.7.1","3.8.0","3.8.0-rc-1","3.9.0","3.9.0-rc-1","3.9.1","3.9.2"]},{"source":"osv","ecosystem":"Maven","package":"com.google.protobuf:protobuf-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.17.0"},{"fixed":"3.19.6"}]}],"versions":["3.17.0","3.17.1","3.17.2","3.17.3","3.18.0","3.18.0-rc-1","3.18.0-rc-2","3.18.1","3.18.2","3.18.3","3.19.0","3.19.0-rc-1","3.19.0-rc-2","3.19.1","3.19.2","3.19.3","3.19.4","3.19.5"]},{"source":"osv","ecosystem":"Maven","package":"com.google.protobuf:protobuf-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.20.0"},{"fixed":"3.20.3"}]}],"versions":["3.20.0","3.20.1","3.20.1-rc-1","3.20.2"]},{"source":"osv","ecosystem":"Maven","package":"com.google.protobuf:protobuf-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.21.0"},{"fixed":"3.21.7"}]}],"versions":["3.21.0","3.21.1","3.21.2","3.21.3","3.21.4","3.21.5","3.21.6"]},{"source":"osv","ecosystem":"Maven","package":"com.google.protobuf:protobuf-javalite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.20.0"},{"fixed":"3.20.3"}]}],"versions":["3.20.0","3.20.1","3.20.1-rc-1","3.20.2"]},{"source":"osv","ecosystem":"Maven","package":"com.google.protobuf:protobuf-javalite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.21.0"},{"fixed":"3.21.7"}]}],"versions":["3.21.0","3.21.1","3.21.2","3.21.3","3.21.4","3.21.5","3.21.6"]},{"source":"osv","ecosystem":"Maven","package":"com.google.protobuf:protobuf-javalite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.16.3"}]}],"versions":["3.10.0","3.10.0-rc-1","3.11.0","3.11.0-rc-1","3.11.0-rc-2","3.11.1","3.11.3","3.11.4","3.12.0","3.12.0-rc-1","3.12.0-rc-2","3.12.1","3.12.2","3.12.4","3.13.0","3.13.0-rc-3","3.14.0","3.14.0-rc-1","3.14.0-rc-2","3.14.0-rc-3","3.15.0","3.15.0-rc-1","3.15.0-rc-2","3.15.1","3.15.2","3.15.3","3.15.4","3.15.5","3.15.6","3.15.7","3.15.8","3.16.0","3.16.0-rc-1","3.16.0-rc-2","3.16.1","3.8.0","3.8.0-rc-1","3.9.0","3.9.0-rc-1","3.9.1","3.9.2"]},{"source":"osv","ecosystem":"Root:Maven","package":"com.google.protobuf:protobuf-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-aikido.1"},{"fixed":"3.21.1-aikido.1"},{"fixed":"3.19.3-aikido.1"},{"fixed":"3.21.1-aikido.2"},{"fixed":"3.19.3-aikido.2"},{"fixed":"3.5.1-aikido.2"},{"fixed":"3.21.7-aikido.1"},{"fixed":"3.21.7-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.com.google.protobuf:protobuf-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-root.io.1"},{"fixed":"3.21.1-root.io.1"},{"fixed":"3.19.3-root.io.1"},{"fixed":"3.21.1-root.io.2"},{"fixed":"3.19.3-root.io.2"},{"fixed":"3.5.1-root.io.2"},{"fixed":"3.21.7-root.io.1"},{"fixed":"3.21.7-root.io.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.1-3ubuntu2","2.4.1-3ubuntu3","2.4.1-3ubuntu4","2.5.0-5ubuntu2","2.5.0-7ubuntu1","2.5.0-8ubuntu1","2.5.0-9ubuntu1","2.5.0-9ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.1-1.2","2.6.1-1.3","2.6.1-1.3ubuntu0.1~esm1","2.6.1-1.3ubuntu0.1~esm2","2.6.1-1.3ubuntu0.1~esm4"]}],"products":[{"vendor":"google","product":"protobuf-java"},{"vendor":"google","product":"protobuf-javalite"},{"vendor":"google","product":"protocolbuffers"}],"references":[{"url":"https://github.com/protocolbuffers/protobuf/commit/a3888f53317a8018e7a439bac4abeb8f3425d5e9","tags":["x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3509","tags":["advisory"]},{"url":"https://github.com/protocolbuffers/protobuf/blob/v2.6.1/java/core/src/main/java/com/google/protobuf/MessageReflection.java","tags":["web"]},{"url":"https://github.com/protocolbuffers/protobuf/blob/v3.0.0/java/core/src/main/java/com/google/protobuf/MessageReflection.java","tags":["web"]},{"url":"https://github.com/advisories/GHSA-g5ww-5jh7-63cx"},{"url":"https://github.com/protocolbuffers/protobuf/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3509.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-3509","tags":["advisory"]},{"url":"https://github.com/protocolbuffers/protobuf/tree/main/java","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2022-3509","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-3509","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-3509","title":"Parsing issue in protobuf textformat","description":"A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.","status":"published","published":"2022-11-01T18:09:31.634Z","modified":"2025-04-22T15:10:13.149Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:34:33.24035Z"}],"euvd":[{"id":"EUVD-2022-7625","description":"A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.","status":"published","published":"2022-11-01T18:09:31Z","modified":"2025-04-22T15:10:13Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:17.280298Z"}],"ghsa":[{"id":"GHSA-g5ww-5jh7-63cx","title":"Protobuf Java vulnerable to Uncontrolled Resource Consumption","description":"A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.","status":"published","published":"2022-12-12T15:30:33Z","modified":"2025-09-02T19:35:40Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:38:55.953734Z"}],"nvd":[{"id":"CVE-2022-3509","description":"A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.","status":"published","published":"2022-12-12T13:15:14.607Z","modified":"2026-06-17T04:59:39.57Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:07:33.649381Z"}],"osv":[{"id":"CVE-2022-3509","title":"Parsing issue in protobuf textformat","description":"A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.","status":"published","published":"2022-11-01T18:09:31.634Z","modified":"2026-10-28T10:26:57.322263186Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:26.195407Z"},{"id":"GHSA-g5ww-5jh7-63cx","title":"Protobuf Java vulnerable to Uncontrolled Resource Consumption","description":"A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.","status":"published","published":"2022-12-12T15:30:33Z","modified":"2026-09-10T03:49:56.533130001Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:47.472172Z"},{"id":"ROOT-APP-MAVEN-CVE-2022-3509","title":"CVE-2022-3509 in com.google.protobuf:protobuf-java - Patched by Root","description":"Root has patched CVE-2022-3509 in the com.google.protobuf:protobuf-java package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-09-10T12:20:54Z","modified":"2026-09-10T13:15:04.017939364Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:27.066589Z"},{"id":"UBUNTU-CVE-2022-3509","description":"A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.","status":"published","published":"2022-12-12T13:15:00Z","modified":"2026-04-22T13:25:17.802607Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:54.697021Z"},{"id":"CLSA-2026-1777250321","title":"TuxCare security update for com.google.protobuf (1 CVE)","description":"TuxCare rebuilt 2 com.google.protobuf packages to address 1 CVE. Fixed in 3.21.1-tuxcare.2.","status":"published","published":"2026-08-04T14:52:28Z","modified":"2026-11-02T19:45:26.61703073Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1791960535","title":"TuxCare security update for com.google.protobuf:protobuf-java (1 CVE)","description":"TuxCare rebuilt com.google.protobuf:protobuf-java to address 1 CVE. Fixed in 2.6.1-tuxcare.2.","status":"published","published":"2026-10-14T06:48:55Z","modified":"2026-10-15T09:45:55.235751833Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791965654","title":"TuxCare security update for com.google.protobuf:protobuf-java (1 CVE)","description":"TuxCare rebuilt com.google.protobuf:protobuf-java to address 1 CVE. Fixed in 2.5.0-tuxcare.2.","status":"published","published":"2026-10-14T08:14:14Z","modified":"2026-10-15T09:45:53.425314305Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792049845","title":"TuxCare security update for com.google.protobuf (3 CVEs)","description":"TuxCare rebuilt 2 com.google.protobuf packages to address 3 CVEs. Fixed in 3.12.0-tuxcare.1.","status":"published","published":"2026-10-15T07:37:25Z","modified":"2026-11-02T19:46:28.003144857Z","updated_at":"2026-11-02T20:29:13.152182Z"},{"id":"CLSA-2026-1792049928","title":"TuxCare security update for com.google.protobuf (2 CVEs)","description":"TuxCare rebuilt 2 com.google.protobuf packages to address 2 CVEs. Fixed in 3.16.1-tuxcare.1.","status":"published","published":"2026-10-15T07:38:48Z","modified":"2026-11-02T19:46:27.801344104Z","updated_at":"2026-11-02T20:29:13.152182Z"},{"id":"CLSA-2026-1792050084","title":"TuxCare security update for com.google.protobuf (2 CVEs)","description":"TuxCare rebuilt 4 com.google.protobuf packages to address 2 CVEs. Fixed in 3.19.2-tuxcare.1.","status":"published","published":"2026-10-15T07:41:24Z","modified":"2026-11-02T19:46:28.374230666Z","updated_at":"2026-11-02T20:29:13.152182Z"},{"id":"CLSA-2026-1793122706","title":"TuxCare security update for com.google.protobuf (3 CVEs)","description":"TuxCare rebuilt 2 com.google.protobuf packages to address 3 CVEs. Fixed in 3.12.2-tuxcare.1.","status":"published","published":"2026-10-27T17:38:26Z","modified":"2026-11-02T19:46:32.3400755Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"DEBIAN-CVE-2022-3509","description":"A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.","status":"published","published":"2022-12-12T13:15:14.607Z","modified":"2026-11-03T06:02:39.220555382Z","updated_at":"2026-11-03T06:43:43.638289Z"}]}}