de.huxhorn.lilith:de.huxhorn.lilith (0.9.36), de.huxhorn.lilith:de.huxhorn.lilith.data.access.protobuf (0.9.36) +7 more potentially affected by CVE-2021-22569 via com.google.protobuf:protobuf-java (2.1.0)

com.google.protobuf:protobuf-java MAVEN version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.google.protobuf:protobuf-java and may be impacted: - de.huxhorn.lilith:de.huxhorn.lilith 0.9.36 -...

cn.ac.ios.tis:riscvspeccore_2.12 (>=0.1.0, <=1.0.0), cn.dustlight.flow:flow-zeebe (>=0.1.3-alpha, <=0.1.7-alpha) +1037 more potentially affected by CVE-2021-22569 via com.google.protobuf:protobuf-java (>=3.18.0, <=3.18.1)

com.google.protobuf:protobuf-java MAVEN version =3.18.0, =0.1.0, =0.1.3-alpha, =0.0.1-alpha, =0.0.2-alpha - cn.vertxup:vertx-co 0.7.0 - cn.vertxup:vertx-ifx 0.7.0 - cn.vertxup:vertx-import 0.7.0 - cn.vertxup:vertx-pin 0.7.0 - cn.vertxup:vertx-rx 0.7.0 - cn.vertxup:vertx-tp 0.7.0 -...

com.apigee.edge.config:apigee-config-maven-plugin (>=1.0, <=1.2.2), com.factual:factual-java-driver (>=1.1.0, <=1.7.8) +49 more potentially affected by CVE-2021-22569 via com.google.protobuf:protobuf-java (2.2.0)

com.google.protobuf:protobuf-java MAVEN version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.google.protobuf:protobuf-java and may be impacted: - com.apigee.edge.config:apigee-config-maven-plugin =1.0, =1.1.0, =1.5.0-beta, =1.7.0-beta,...

ai.api.libai.speech:libai-speech-gcp (>=1.4.6, <=1.6.12), ai.bareun.tagger:bareun (1.4.2) +17682 more potentially affected by CVE-2021-22569 via com.google.protobuf:protobuf-java (>=3.0.0-alpha-2, <=3.16.0)

com.google.protobuf:protobuf-java MAVEN version =3.0.0-alpha-2, =1.4.6, =0.6, =0.6.0, =0.6.0, =0.6.0, =0.11.0, =1.3.0, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =1.4.1 and mo...

ai.superstream:kafka-clients (>=3.0.1-alpha, <=3.6.1-alpha1), ai.superstream:spring-kafka (>=2.8.4-alpha1, <=3.0.1-alpha1) +1387 more potentially affected by CVE-2021-22569 via com.google.protobuf:protobuf-java (>=3.19.0, <=3.19.1)

com.google.protobuf:protobuf-java MAVEN version =3.19.0, =3.0.1-alpha, =2.8.4-alpha1, =0.0.1-alpha1, =21.9.4, =21.9.4, =21.9.4, =21.9.4, =0.6.9-rc.2, =0.10.3, =0.10.3, =0.10.3, =0.10.3, =0.10.3, =0.10.3, =0.10.3, =0.10.4 and more Source cves: CVE-2021-22569 Source advisory: OSV:GHSA-WRVW-HG22-4M6...

ai.superstream:kafka-clients (>=3.0.1-alpha, <=3.6.1-alpha1), ai.superstream:spring-kafka (>=2.8.4-alpha1, <=3.0.1-alpha1) +1387 more potentially affected by CVE-2021-22569 via com.google.protobuf:protobuf-java (>=3.19.0, <=3.19.1)

com.google.protobuf:protobuf-java MAVEN version =3.19.0, =3.0.1-alpha, =2.8.4-alpha1, =0.0.1-alpha1, =21.9.4, =21.9.4, =21.9.4, =21.9.4, =0.6.9-rc.2, =0.10.3, =0.10.3, =0.10.3, =0.10.3, =0.10.3, =0.10.3, =0.10.3, =0.10.4 and more Source cves: CVE-2021-22569 Source advisory: GHSA-WRVW-HG22-4M67...

de.huxhorn.lilith:de.huxhorn.lilith (0.9.35), de.huxhorn.lilith:de.huxhorn.lilith.data.access.protobuf (0.9.35) +16 more potentially affected by CVE-2021-22569 via com.google.protobuf:protobuf-java (2.0.3)

com.google.protobuf:protobuf-java MAVEN version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.google.protobuf:protobuf-java and may be impacted: - de.huxhorn.lilith:de.huxhorn.lilith 0.9.35 -...

ai.api.libai.speech:libai-speech-gcp (>=1.4.6, <=1.6.12), ai.bareun.tagger:bareun (1.4.2) +17682 more potentially affected by CVE-2021-22569 via com.google.protobuf:protobuf-java (>=3.0.0-alpha-2, <=3.16.0)

com.google.protobuf:protobuf-java MAVEN version =3.0.0-alpha-2, =1.4.6, =0.6, =0.6.0, =0.6.0, =0.6.0, =0.11.0, =1.3.0, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =1.4.1 and mo...

A potential Denial of Service issue in protobuf-java

Summary A potential Denial of Service issue in protobuf-java was discovered in the parsing procedure for binary data. Affected versions: All versions of Java Protobufs including Kotlin and JRuby prior to the versions listed below. Protobuf "javalite" users typically Android are not affected...

CVE-2021-22569

CVE-2021-22569 concerns protobuf-java: an issue allowing interleaving of UnknownFieldSet fields that can cause the parser to linger due to many short-lived objects, potentially enabling DoS-like pauses. Connected sources show this vulnerability in multiple ecosystems (e.g., Debian protobuf packag...

CVE-2021-22569 Denial of Service of protobuf-java parsing procedure

An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated...

cn.ac.ios.tis:riscvspeccore_2.12 (>=0.1.0, <=1.0.0), cn.dustlight.flow:flow-zeebe (>=0.1.3-alpha, <=0.1.7-alpha) +1037 more potentially affected by CVE-2021-22569 via com.google.protobuf:protobuf-java (>=3.18.0, <=3.18.1)

com.google.protobuf:protobuf-java MAVEN version =3.18.0, =0.1.0, =0.1.3-alpha, =0.0.1-alpha, =0.0.2-alpha - cn.vertxup:vertx-co 0.7.0 - cn.vertxup:vertx-ifx 0.7.0 - cn.vertxup:vertx-import 0.7.0 - cn.vertxup:vertx-pin 0.7.0 - cn.vertxup:vertx-rx 0.7.0 - cn.vertxup:vertx-tp 0.7.0 -...

ae.teletronics.nlp:entityextraction (1.3), ae.teletronics.nlp:w2vec (1.0) +27499 more potentially affected by CVE-2021-22569 via com.google.protobuf:protobuf-java (>=2.0.3, <=3.16.0)

com.google.protobuf:protobuf-java MAVEN version =2.0.3, =1.4.6, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2.10 and more Source cves: CVE-2021-22569 Source advisory: MEND:CVE-2021-22569...

CVE-2021-22569

An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated...

CVE-2021-22569: Incorrect Behavior Order

An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated...

ai.superstream:kafka-clients (>=3.0.1-alpha, <=3.6.1-alpha1), ai.superstream:spring-kafka (>=2.8.4-alpha1, <=3.0.1-alpha1) +1387 more potentially affected by CVE-2021-22569 via com.google.protobuf:protobuf-java (>=3.19.0, <=3.19.1)

com.google.protobuf:protobuf-java MAVEN version =3.19.0, =3.0.1-alpha, =2.8.4-alpha1, =0.0.1-alpha1, =21.9.4, =21.9.4, =21.9.4, =21.9.4, =0.6.9-rc.2, =0.10.3, =0.10.3, =0.10.3, =0.10.3, =0.10.3, =0.10.3, =0.10.3, =0.10.4 and more Source cves: CVE-2021-22569 Source advisory: MEND:CVE-2021-22569...

CVE-2021-22569 Denial of Service of protobuf-java parsing procedure

An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated...

CVE-2021-22569

An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated...

protobuf-java:ProtobufFuzzer: Timeout in ProtobufFuzzer

Detailed Report: https://oss-fuzz.com/testcase?key=6156425441705984 Project: protobuf-java Fuzzing Engine: libFuzzer Fuzz Target: ProtobufFuzzer Job Type: libfuzzerasanprotobuf-java Platform Id: linux Crash Type: Timeout exceeds 60 secs Crash Address: Crash State: ProtobufFuzzer Sanitizer: addres...