CVE-2022-3171

What it actually does

A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses.

Why it matters to the business

Services relying on protobuf parsing may experience availability disruptions or outages from resource exhaustion triggered by crafted inputs, increasing operational costs and affecting downstream systems that depend on the library.

How an attack unfolds

An attacker crafts a protobuf message containing multiple non-repeated embedded messages with repeated or unknown fields and sends it to a vulnerable application, causing repeated mutable-to-immutable conversions that trigger extended garbage collection pauses and denial of service.

How to fix it

Update protocolbuffers/protobuf to the fixed commit b8c2488f480bbe3d66b9874c2fcd434201caa48a or to versions 3.21.7, 3.20.3, 3.19.6, 3.16.3 or later in all dependencies.

How to confirm the fix worked

Confirm the protobuf-java version in build files or runtime dependencies meets or exceeds the fixed versions, then test parsing of multi-embedded message inputs to verify absence of excessive GC activity.

Typical attack path

1. Identify a network-accessible service using vulnerable protobuf-java
2. Craft a binary protobuf payload with multiple non-repeated embedded messages containing repeated or unknown fields
3. Transmit the payload to trigger parsing
4. Induce repeated object conversions leading to prolonged GC pauses and service degradation

How to detect it

Review application logs and Java runtime metrics for sudden spikes in garbage collection duration or CPU usage during protobuf deserialization; correlate with inbound network traffic containing protobuf payloads.

What your security team should do

• Prioritize upgrade of protobuf-java across all affected packages to the fixed commit or listed versions
• Audit dependency trees for transitive protobuf usage and enforce version pinning
• Monitor Java GC metrics in applications handling protobuf data for anomalous pauses