Google LLC Protobuf Java vulnerabilities

1 vulnerability

Known vulnerabilities in Google LLC Protobuf Java, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

7.5CVE-2021-22569chainguardceleborn-0.5+146
EPSS score
1.67%
An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated pauses. We recommend upgrading libraries beyond the vulnerable versions.