CVE-2022-3510

What it actually does

Specially crafted protobuf inputs with multiple non-repeated embedded messages containing repeated or unknown fields trigger repeated mutable-to-immutable conversions in protobuf-java core and lite, causing extended garbage collection pauses and denial of service.

Why it matters to the business

Applications handling untrusted protobuf data may experience prolonged unresponsiveness or outages, increasing operational costs and disrupting dependent services across ecosystems with high protobuf usage.

How an attack unfolds

An attacker sends a network or file input containing repeated instances of non-repeated embedded messages with repeated or unknown fields to a vulnerable protobuf-java parser; the library repeatedly converts objects between mutable and immutable forms, exhausting CPU time in garbage collection and denying service to legitimate users.

How to fix it

Upgrade protocolbuffers/protobuf (GIT) to the fixed commit db7c17803320525722f45c1d26fc08bc41d1bf48 or adopt protobuf-java versions 3.21.7, 3.20.3, 3.19.6 or 3.16.3 or later. Validate all downstream dependencies and rebuild affected applications.

How to confirm the fix worked

Confirm the protobuf-java version in use matches a fixed release, then replay known trigger inputs in a test environment to verify absence of long GC pauses and service availability under load.

Typical attack path

1. Identify a service accepting protobuf messages over the network or via files
2. Craft a message with multiple non-repeated embedded messages that include repeated or unknown fields
3. Transmit the malicious protobuf payload to the target parser
4. Observe resource exhaustion from repeated mutable/immutable conversions and extended GC pauses

How to detect it

Review application and garbage collection logs for unusually long pause durations coinciding with protobuf parsing activity; correlate with inbound message volume spikes from untrusted sources.

What your security team should do

• Immediately inventory all applications using protobuf-java and schedule upgrades to fixed versions
• Apply network-level input validation or size limits on protobuf messages as a temporary control
• Monitor application logs and GC metrics for sudden spikes after any exposure window