CVE-2022-3509

What it actually does

Parsing of specially crafted textformat inputs containing multiple non-repeated embedded messages with repeated or unknown fields triggers repeated mutable-to-immutable conversions in protobuf-java core and lite, producing extended garbage collection pauses that result in denial of service.

Why it matters to the business

Attackers can remotely disrupt availability of any service that parses untrusted protobuf textformat data, causing outages or degraded performance until the process is restarted or the garbage collector recovers.

How an attack unfolds

An attacker sends a crafted textformat payload over the network to any exposed protobuf-java parser; the input triggers repeated object conversions that consume CPU and memory during garbage collection, leading to service unresponsiveness.

How to fix it

Upgrade protocolbuffers/protobuf (GIT) to commit a3888f53317a8018e7a439bac4abeb8f3425d5e9 or later; for Maven/Gradle users, update protobuf-java and protobuf-java-util to 3.21.7, 3.20.3, 3.19.6, or 3.16.3.

How to confirm the fix worked

Confirm the protobuf-java dependency version is at or above one of the fixed releases; re-test parsing of the original malicious textformat payload to verify that excessive GC pauses no longer occur.

Typical attack path

1. Identify a network-accessible endpoint that accepts protobuf textformat input
2. Craft a message containing multiple non-repeated embedded messages with repeated or unknown fields
3. Transmit the payload to the target parser
4. Observe prolonged garbage collection pauses that render the service unavailable

How to detect it

Monitor application logs for repeated garbage collection warnings or unusually long GC pause times during protobuf textformat parsing; correlate with inbound requests containing protobuf content-type or textformat payloads.

What your security team should do

• Immediately update all protobuf-java usages to a fixed version
• Add dependency scanning to CI pipelines to block vulnerable protobuf releases
• Review any custom textformat parsers for similar conversion patterns