{"id":"CVE-2022-3510","aliases":["BELL-CVE-2022-3510","DEBIAN-CVE-2022-3510","EUVD-2022-7503","GHSA-4gg5-vx3j-xwc7","ROOT-APP-MAVEN-CVE-2022-3510","UBUNTU-CVE-2022-3510"],"status":"published","title":"Parsing issue in protobuf message-type extension","description":"A parsing issue similar to CVE-2022-3171, but with Message-Type Extensions in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00769,"percentile":0.55848,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2022-11-11T16:35:20Z","modified":"2026-10-28T10:27:00Z","fixes":[{"ecosystem":"Maven","package":"com.google.protobuf:protobuf-java","fixed_in":["3.19.6","3.20.3","3.21.7","3.16.3"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"com.google.protobuf:protobuf-javalite","fixed_in":["3.19.6","3.20.3","3.21.7","3.16.3"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"protobuf","fixed_in":["3.21.9-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"protobuf","fixed_in":["3.21.9-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"protobuf","fixed_in":["3.21.9-3"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"com.google.protobuf:protobuf-java","fixed_in":["3.5.1-aikido.1","3.21.1-aikido.1","3.19.3-aikido.1","3.21.1-aikido.2","3.19.3-aikido.2","3.5.1-aikido.2","3.21.7-aikido.1","3.21.7-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.com.google.protobuf:protobuf-java","fixed_in":["3.5.1-root.io.1","3.21.1-root.io.1","3.19.3-root.io.1","3.21.1-root.io.2","3.19.3-root.io.2","3.5.1-root.io.2","3.21.7-root.io.1","3.21.7-root.io.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.google.protobuf:protobuf-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.17.0"},{"fixed":"3.19.6"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.google.protobuf:protobuf-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.20.0"},{"fixed":"3.20.3"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.google.protobuf:protobuf-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.21.0"},{"fixed":"3.21.7"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.google.protobuf:protobuf-javalite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.17.0"},{"fixed":"3.19.6"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.google.protobuf:protobuf-javalite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.20.0"},{"fixed":"3.20.3"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.google.protobuf:protobuf-javalite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.21.0"},{"fixed":"3.21.7"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.google.protobuf:protobuf-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.16.3"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.google.protobuf:protobuf-javalite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.16.3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.9-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.9-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.9-3"}]}]},{"source":"osv","ecosystem":"Maven","package":"com.google.protobuf:protobuf-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.16.3"}]}],"versions":["3.0.0","3.0.2","3.1.0","3.10.0","3.10.0-rc-1","3.11.0","3.11.0-rc-1","3.11.0-rc-2","3.11.1","3.11.3","3.11.4","3.12.0","3.12.0-rc-1","3.12.0-rc-2","3.12.1","3.12.2","3.12.4","3.13.0","3.13.0-rc-3","3.14.0","3.14.0-rc-1","3.14.0-rc-2","3.14.0-rc-3","3.15.0","3.15.0-rc-1","3.15.0-rc-2","3.15.1","3.15.2","3.15.3","3.15.4","3.15.5","3.15.6","3.15.7","3.15.8","3.16.0","3.16.0-rc-1","3.16.0-rc-2","3.16.1","3.2.0","3.2.0-rc.1","3.2.0rc2","3.3.0","3.3.1","3.4.0","3.5.0","3.5.1","3.6.0","3.6.1","3.7.0","3.7.0-rc1","3.7.1","3.8.0","3.8.0-rc-1","3.9.0","3.9.0-rc-1","3.9.1","3.9.2"]},{"source":"osv","ecosystem":"Maven","package":"com.google.protobuf:protobuf-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.17.0"},{"fixed":"3.19.6"}]}],"versions":["3.17.0","3.17.1","3.17.2","3.17.3","3.18.0","3.18.0-rc-1","3.18.0-rc-2","3.18.1","3.18.2","3.18.3","3.19.0","3.19.0-rc-1","3.19.0-rc-2","3.19.1","3.19.2","3.19.3","3.19.4","3.19.5"]},{"source":"osv","ecosystem":"Maven","package":"com.google.protobuf:protobuf-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.20.0"},{"fixed":"3.20.3"}]}],"versions":["3.20.0","3.20.1","3.20.1-rc-1","3.20.2"]},{"source":"osv","ecosystem":"Maven","package":"com.google.protobuf:protobuf-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.21.0"},{"fixed":"3.21.7"}]}],"versions":["3.21.0","3.21.1","3.21.2","3.21.3","3.21.4","3.21.5","3.21.6"]},{"source":"osv","ecosystem":"Maven","package":"com.google.protobuf:protobuf-javalite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.16.3"}]}],"versions":["3.10.0","3.10.0-rc-1","3.11.0","3.11.0-rc-1","3.11.0-rc-2","3.11.1","3.11.3","3.11.4","3.12.0","3.12.0-rc-1","3.12.0-rc-2","3.12.1","3.12.2","3.12.4","3.13.0","3.13.0-rc-3","3.14.0","3.14.0-rc-1","3.14.0-rc-2","3.14.0-rc-3","3.15.0","3.15.0-rc-1","3.15.0-rc-2","3.15.1","3.15.2","3.15.3","3.15.4","3.15.5","3.15.6","3.15.7","3.15.8","3.16.0","3.16.0-rc-1","3.16.0-rc-2","3.16.1","3.8.0","3.8.0-rc-1","3.9.0","3.9.0-rc-1","3.9.1","3.9.2"]},{"source":"osv","ecosystem":"Maven","package":"com.google.protobuf:protobuf-javalite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.17.0"},{"fixed":"3.19.6"}]}],"versions":["3.17.0","3.17.1","3.17.2","3.17.3","3.18.0","3.18.0-rc-1","3.18.0-rc-2","3.18.1","3.18.2","3.18.3","3.19.0","3.19.0-rc-1","3.19.0-rc-2","3.19.1","3.19.2","3.19.3","3.19.4","3.19.5"]},{"source":"osv","ecosystem":"Maven","package":"com.google.protobuf:protobuf-javalite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.20.0"},{"fixed":"3.20.3"}]}],"versions":["3.20.0","3.20.1","3.20.1-rc-1","3.20.2"]},{"source":"osv","ecosystem":"Maven","package":"com.google.protobuf:protobuf-javalite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.21.0"},{"fixed":"3.21.7"}]}],"versions":["3.21.0","3.21.1","3.21.2","3.21.3","3.21.4","3.21.5","3.21.6"]},{"source":"osv","ecosystem":"Root:Maven","package":"com.google.protobuf:protobuf-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-aikido.1"},{"fixed":"3.21.1-aikido.1"},{"fixed":"3.19.3-aikido.1"},{"fixed":"3.21.1-aikido.2"},{"fixed":"3.19.3-aikido.2"},{"fixed":"3.5.1-aikido.2"},{"fixed":"3.21.7-aikido.1"},{"fixed":"3.21.7-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.com.google.protobuf:protobuf-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-root.io.1"},{"fixed":"3.21.1-root.io.1"},{"fixed":"3.19.3-root.io.1"},{"fixed":"3.21.1-root.io.2"},{"fixed":"3.19.3-root.io.2"},{"fixed":"3.5.1-root.io.2"},{"fixed":"3.21.7-root.io.1"},{"fixed":"3.21.7-root.io.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.1-3ubuntu2","2.4.1-3ubuntu3","2.4.1-3ubuntu4","2.5.0-5ubuntu2","2.5.0-7ubuntu1","2.5.0-8ubuntu1","2.5.0-9ubuntu1","2.5.0-9ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.1-1.2","2.6.1-1.3","2.6.1-1.3ubuntu0.1~esm1","2.6.1-1.3ubuntu0.1~esm2","2.6.1-1.3ubuntu0.1~esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.0-9ubuntu5","3.0.0-9ubuntu6","3.0.0-9.1ubuntu1","3.0.0-9.1ubuntu1.1","3.0.0-9.1ubuntu1.1+esm3","3.0.0-9.1ubuntu1.1+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.1.3-2","3.6.1.3-2ubuntu1","3.6.1.3-2ubuntu3","3.6.1.3-2ubuntu4","3.6.1.3-2ubuntu5","3.6.1.3-2ubuntu5.2","3.6.1.3-2ubuntu5.2+esm2","3.6.1.3-2ubuntu5.2+esm3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.12.4-1ubuntu3","3.12.4-1ubuntu5","3.12.4-1ubuntu6","3.12.4-1ubuntu7","3.12.4-1ubuntu7.22.04.1","3.12.4-1ubuntu7.22.04.2","3.12.4-1ubuntu7.22.04.4","3.12.4-1ubuntu7.22.04.6"]}],"products":[{"vendor":"google","product":"protobuf-java"},{"vendor":"google","product":"protobuf-javalite"},{"vendor":"google","product":"protocolbuffers"}],"references":[{"url":"https://github.com/protocolbuffers/protobuf/commit/db7c17803320525722f45c1d26fc08bc41d1bf48","tags":["patch","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3510","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4gg5-vx3j-xwc7"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2022-3510","tags":["advisory"]},{"url":"https://github.com/protocolbuffers/protobuf/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3510.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-3510","tags":["advisory"]},{"url":"https://github.com/protocolbuffers/protobuf/tree/main/java","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2022-3510","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-3510","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-3510","title":"Parsing issue in protobuf message-type extension","description":"A parsing issue similar to CVE-2022-3171, but with Message-Type Extensions in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.\n\n","status":"published","published":"2022-11-11T16:35:20.765Z","modified":"2025-04-22T15:09:17.05Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:34:33.24035Z"}],"euvd":[{"id":"EUVD-2022-7503","description":"A parsing issue similar to CVE-2022-3171, but with Message-Type Extensions in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.\n\n","status":"published","published":"2022-11-11T16:35:20Z","modified":"2025-04-22T15:09:17Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:17.280298Z"}],"ghsa":[{"id":"GHSA-4gg5-vx3j-xwc7","title":"Protobuf Java vulnerable to Uncontrolled Resource Consumption","description":"A parsing issue similar to CVE-2022-3171, but with Message-Type Extensions in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.","status":"published","published":"2022-12-12T15:30:33Z","modified":"2025-09-02T19:38:12Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:38:55.953734Z"}],"nvd":[{"id":"CVE-2022-3510","description":"A parsing issue similar to CVE-2022-3171, but with Message-Type Extensions in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.\n\n","status":"published","published":"2022-12-12T13:15:14.67Z","modified":"2026-06-17T04:59:39.683Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:07:33.649381Z"}],"osv":[{"id":"BELL-CVE-2022-3510","title":"CVE-2022-3510 does not affect BellSoft software","status":"withdrawn","published":"2022-12-12T13:15:00Z","modified":"2026-09-06T07:15:16.172320431Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:17.151188Z"},{"id":"CVE-2022-3510","title":"Parsing issue in protobuf message-type extension","description":"A parsing issue similar to CVE-2022-3171, but with Message-Type Extensions in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.\n\n","status":"published","published":"2022-11-11T16:35:20.765Z","modified":"2026-10-28T10:27:00.473109121Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:26.195407Z"},{"id":"DEBIAN-CVE-2022-3510","description":"A parsing issue similar to CVE-2022-3171, but with Message-Type Extensions in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.","status":"published","published":"2022-12-12T13:15:14.67Z","modified":"2026-11-03T08:04:08.763867221Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T08:23:07.763774Z"},{"id":"GHSA-4gg5-vx3j-xwc7","title":"Protobuf Java vulnerable to Uncontrolled Resource Consumption","description":"A parsing issue similar to CVE-2022-3171, but with Message-Type Extensions in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.","status":"published","published":"2022-12-12T15:30:33Z","modified":"2026-09-10T03:49:56.342397008Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:37.148947Z"},{"id":"ROOT-APP-MAVEN-CVE-2022-3510","title":"CVE-2022-3510 in com.google.protobuf:protobuf-java - Patched by Root","description":"Root has patched CVE-2022-3510 in the com.google.protobuf:protobuf-java package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-09-10T12:20:54Z","modified":"2026-09-10T13:15:05.113759885Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:27.066589Z"},{"id":"UBUNTU-CVE-2022-3510","description":"A parsing issue similar to CVE-2022-3171, but with Message-Type Extensions in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.","status":"published","published":"2022-12-12T13:15:00Z","modified":"2026-05-26T21:30:06.643558671Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:54.697021Z"}]}}