CVE-2021-22569

Published: Jan 10, 2022Modified: Jun 17, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated pauses. We recommend upgrading libraries beyond the vulnerable versions.

Affected (12)

Products: Google: Google Protobuf, Protobuf Java, Protobuf Kotlin · Oracle: Communications Cloud Native Core Console, Communications Cloud Native Core Network Repository Function, Communications Cloud Native Core Policy, Spatial And Graph Mapviewer

3 products

4 products

Communications Cloud Native Core Console

Communications Cloud Native Core Network Repository Function

Communications Cloud Native Core Policy

Spatial And Graph Mapviewer

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Google Google Protobuf	Before 3.19.2
Google Protobuf Java	Before 3.16.1
Google Protobuf Java	From 3.18.0 to 3.18.2
Google Protobuf Java	From 3.19.0 to 3.19.2
Google Protobuf Kotlin	Before 3.18.2
Google Protobuf Kotlin	From 3.19.0 to 3.19.2

Configuration B

6 vulnerable

Vulnerable Software	Affected Versions
Oracle Communications Cloud Native Core Console	Version 1.9.0
Oracle Communications Cloud Native Core Network Repository Function	Version 1.15.0
Oracle Communications Cloud Native Core Network Repository Function	Version 1.15.1
Oracle Communications Cloud Native Core Policy	Version 1.15.0
Oracle Spatial And Graph Mapviewer	Version 19c
Oracle Spatial And Graph Mapviewer	Version 21c