CVE-2021-22569 — Denial of Service of protobuf-java parsing procedure
An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload ca…
Published: 2022-01-07 · CVSS: 7.5 · CVSS 3.1
An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated pauses. We recommend upgrading libraries beyond the vulnerable versions.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7