title: Memory handling vulnerability in ProtocolBuffers Java core and lite
description: A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.
problem types: CWE-20 Improper Input Validation
affected:
{
vendor: Google LLC
product: Protocolbuffers
versions:
version: 3.21.7, status: affected, lessThan: 3.21.7, versionType: custom
version: 3.20.3, status: affected, lessThan: 3.20.3, versionType: custom
version: 3.19.6, status: affected, lessThan: 3.19.6, versionType: custom
version: 3.16.3, status: affected, lessThan: 3.16.3, versionType: custom
platforms: core and lite
}
metrics:
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
attackVector: ADJACENT_NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
]