CVE-2021-22569
Estado: ModificadaMedia (5.5)—
An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated pauses. We recommend upgrading libraries beyond the vulnerable versions.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- Puntuación base: 5.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 1.67%
- Percentil entre todas las CVEs puntuadas: 76
- Fecha de la puntuación: 5/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (7)
CWE
- CWE-696
- NVD-CWE-noinfo
Referencias
- http://www.openwall.com/lists/oss-security/2022/01/12/4
- http://www.openwall.com/lists/oss-security/2022/01/12/7
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39330
- https://cloud.google.com/support/bulletins#gcp-2022-001
- https://lists.debian.org/debian-lts-announce/2023/04/msg00019.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- http://www.openwall.com/lists/oss-security/2022/01/12/4
- http://www.openwall.com/lists/oss-security/2022/01/12/7
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39330
- https://cloud.google.com/support/bulletins#gcp-2022-001
- https://lists.debian.org/debian-lts-announce/2023/04/msg00019.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
JSON original (NVD)
Mostrar
{
"id": "CVE-2021-22569",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2021-22569",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2025-04-21T13:40:37.923955Z"
}
}
],
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 4.3,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"authentication": "NONE",
"integrityImpact": "NONE",
"accessComplexity": "MEDIUM",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "cve-coordination@google.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.5,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 3.9
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.5,
"attackVector": "LOCAL",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "cve-coordination@google.com",
"affectedData": [
{
"vendor": "Google LLC",
"product": "protobuf-java",
"versions": [
{
"status": "affected",
"version": "unspecified",
"lessThan": "3.16.1",
"versionType": "custom"
},
{
"status": "affected",
"version": "unspecified",
"lessThan": "3.18.2",
"versionType": "custom"
},
{
"status": "affected",
"version": "unspecified",
"lessThan": "3.19.2",
"versionType": "custom"
}
]
},
{
"vendor": "Google LLC",
"product": "protobuf-kotlin",
"versions": [
{
"status": "affected",
"version": "unspecified",
"lessThan": "3.18.2",
"versionType": "custom"
},
{
"status": "affected",
"version": "unspecified",
"lessThan": "3.19.2",
"versionType": "custom"
}
]
},
{
"vendor": "Google LLC",
"product": "google-protobuf [JRuby Gem]",
"versions": [
{
"status": "affected",
"version": "unspecified",
"lessThan": "3.19.2",
"versionType": "custom"
}
]
}
]
}
],
"published": "2022-01-10T14:10:16.747",
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2022/01/12/4",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "cve-coordination@google.com"
},
{
"url": "http://www.openwall.com/lists/oss-security/2022/01/12/7",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "cve-coordination@google.com"
},
{
"url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39330",
"tags": [
"Exploit",
"Issue Tracking",
"Mailing List",
"Vendor Advisory"
],
"source": "cve-coordination@google.com"
},
{
"url": "https://cloud.google.com/support/bulletins#gcp-2022-001",
"tags": [
"Vendor Advisory"
],
"source": "cve-coordination@google.com"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00019.html",
"source": "cve-coordination@google.com"
},
{
"url": "https://www.oracle.com/security-alerts/cpuapr2022.html",
"tags": [
"Patch",
"Third Party Advisory"
],
"source": "cve-coordination@google.com"
},
{
"url": "http://www.openwall.com/lists/oss-security/2022/01/12/4",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.openwall.com/lists/oss-security/2022/01/12/7",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39330",
"tags": [
"Exploit",
"Issue Tracking",
"Mailing List",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://cloud.google.com/support/bulletins#gcp-2022-001",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00019.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.oracle.com/security-alerts/cpuapr2022.html",
"tags": [
"Patch",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "cve-coordination@google.com",
"description": [
{
"lang": "en",
"value": "CWE-696"
}
]
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated pauses. We recommend upgrading libraries beyond the vulnerable versions."
},
{
"lang": "es",
"value": "Un problema en protobuf-java permitía intercalar campos com.google.protobuf.UnknownFieldSet de tal manera que eran procesados fuera de orden. Una pequeña carga útil maliciosa puede ocupar el analizador durante varios minutos al crear un gran número de objetos de corta duración que causan frecuentes y repetidas pausas. Recomendamos actualizar las bibliotecas más allá de las versiones vulnerables"
}
],
"lastModified": "2026-06-17T03:37:26.723",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:google:google-protobuf:*:*:*:*:*:ruby:*:*",
"vulnerable": true,
"matchCriteriaId": "01422CF6-13DE-42DF-A6FF-67E70D40DE6E",
"versionEndExcluding": "3.19.2"
},
{
"criteria": "cpe:2.3:a:google:protobuf-java:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9CAAA7EA-1EE1-433E-939A-B25BDE08FF22",
"versionEndExcluding": "3.16.1"
},
{
"criteria": "cpe:2.3:a:google:protobuf-java:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FBBE87EA-F13D-4A0A-AF42-A361AB4F6611",
"versionEndExcluding": "3.18.2",
"versionStartIncluding": "3.18.0"
},
{
"criteria": "cpe:2.3:a:google:protobuf-java:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5707A6F9-0CEC-4CAA-B860-EBFA2D525B64",
"versionEndExcluding": "3.19.2",
"versionStartIncluding": "3.19.0"
},
{
"criteria": "cpe:2.3:a:google:protobuf-kotlin:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A252BD12-1555-4E89-B671-D459D3F149E0",
"versionEndExcluding": "3.18.2"
},
{
"criteria": "cpe:2.3:a:google:protobuf-kotlin:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "329F610C-F8CB-4009-B3A2-D0CB7FDDCB28",
"versionEndExcluding": "3.19.2",
"versionStartIncluding": "3.19.0"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_console:1.9.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DAAB7154-4DE8-4806-86D0-C1D33B84417B"
},
{
"criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6F60E32F-0CA0-4C2D-9848-CB92765A9ACB"
},
{
"criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DF616620-88CE-4A77-B904-C1728A2E6F9B"
},
{
"criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B4367D9B-BF81-47AD-A840-AC46317C774D"
},
{
"criteria": "cpe:2.3:a:oracle:spatial_and_graph_mapviewer:19c:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D5291552-F823-48E6-B9D8-E94740C4CEFE"
},
{
"criteria": "cpe:2.3:a:oracle:spatial_and_graph_mapviewer:21c:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "051613BE-6E8E-4865-8DA5-24352E9B9AD0"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve-coordination@google.com"
}