CVE-2021-22569

What it actually does

Maliciously interleaved com.google.protobuf.UnknownFieldSet entries in protobuf messages trigger excessive short-lived object allocation during parsing, causing repeated GC pauses that occupy the parser thread for minutes.

Why it matters to the business

Services relying on the affected protobuf library can be rendered unresponsive for extended periods by a single small input, leading to degraded availability and potential service outages.

How an attack unfolds

An attacker crafts a compact protobuf payload containing interleaved UnknownFieldSet fields and supplies it to any application that parses untrusted protobuf data with the vulnerable library, forcing prolonged CPU-bound object churn.

How to fix it

Upgrade protocolbuffers/protobuf to commit cb46755e6405e083b45481f5ea4754b180705529 or later; for emacs on Debian 10 upgrade to package version 1:26.1+1-3.2+deb10u4 or newer. Rebuild and redeploy all dependent artifacts after the library update.

How to confirm the fix worked

Verify the protobuf-java or protobuf dependency version matches or exceeds the listed fixed versions; replay a known malicious interleaved UnknownFieldSet payload in a test harness and confirm parsing completes within seconds rather than minutes.

Typical attack path

1. Locate an application or service that accepts protobuf input using a vulnerable protobuf-java version
2. Generate a minimal protobuf message embedding many interleaved UnknownFieldSet fields
3. Deliver the payload through any accepted input channel (file, network, API)
4. Trigger parsing, causing sustained high CPU and memory churn that blocks the thread for minutes

How to detect it

Review application logs and performance metrics for protobuf parse operations that exceed normal duration thresholds; correlate with sudden spikes in short-lived object allocations or GC pause times on hosts running vulnerable library versions.

What your security team should do

• Immediately inventory all Java and native applications that depend on protobuf-java or the protobuf C++ core
• Prioritize upgrade of any internet-facing or multi-tenant services to the fixed commits or Debian packages
• Add protobuf version checks to CI/CD pipelines and dependency scanners
• Monitor for unusually long protobuf parse times or elevated GC activity as a temporary compensating control