Cyber Resilience

CVE-2021-22569

HighPublic PoC

Published: 10 January 2022

Published
10 January 2022
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0047 65.0th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2021-22569 is a high-severity Incorrect Behavior Order (CWE-696) vulnerability in Google Protobuf-Java. Its CVSS base score is 7.5 (High).

Operationally, ranked in the top 35.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability details

An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that…

more

cause frequent, repeated pauses. We recommend upgrading libraries beyond the vulnerable versions.

CWE(s)
CWE-696NVD-CWE-noinfo

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

google
google-protobuf
≤ 3.19.2
google
protobuf-java
≤ 3.16.1 · 3.18.0 — 3.18.2 · 3.19.0 — 3.19.2
google
protobuf-kotlin
≤ 3.18.2 · 3.19.0 — 3.19.2
oracle
communications cloud native core console
1.9.0
oracle
communications cloud native core network repository function
1.15.0, 1.15.1
oracle
communications cloud native core policy
1.15.0
oracle
spatial and graph mapviewer
19c, 21c

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References