Filtered by vendor Google Subscriptions
Filtered by product Protobuf-javalite Subscriptions
Total 4 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-7254 2 Google, Redhat 10 Google-protobuf, Protobuf, Protobuf-java and 7 more 2024-12-13 7.5 High
Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.
CVE-2022-3510 2 Google, Redhat 5 Protobuf-java, Protobuf-javalite, Jboss Enterprise Bpms Platform and 2 more 2024-11-21 7.5 High
A parsing issue similar to CVE-2022-3171, but with Message-Type Extensions in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.
CVE-2022-3509 2 Google, Redhat 5 Protobuf-java, Protobuf-javalite, Jboss Enterprise Bpms Platform and 2 more 2024-11-21 7.5 High
A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.
CVE-2022-3171 3 Fedoraproject, Google, Redhat 10 Fedora, Google-protobuf, Protobuf-java and 7 more 2024-11-21 4.3 Medium
A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.