{"action":"Upgrade com.google.protobuf:protobuf-java to 3.16.3 (3.16.x), 3.19.6 (3.19.x), 3.20.3 (3.20.x) or 3.21.7 (3.21.x) or later.","affected":[{"fixed":"3.16.3","introduced":"3.0.0"},{"fixed":"3.19.6","introduced":"3.17.0"},{"fixed":"3.20.3","introduced":"3.20.0"},{"fixed":"3.21.7","introduced":"3.21.0"}],"component":"com.google.protobuf:protobuf-java","cve_ids":["CVE-2022-3509"],"ecosystem":"Maven","epss":0.00902,"exploited":false,"fixed_versions":["3.16.3","3.19.6","3.20.3","3.21.7"],"ghsa_id":"GHSA-g5ww-5jh7-63cx","id":"tcs_01M5N8XG3S2FT01DTYCBP04CQX","modified_at":"2026-09-10T03:49:56.533130001Z","published_at":"2022-12-12T15:30:33Z","references":["https://osv.dev/vulnerability/GHSA-g5ww-5jh7-63cx","https://nvd.nist.gov/vuln/detail/CVE-2022-3509","https://github.com/protocolbuffers/protobuf/commit/a3888f53317a8018e7a439bac4abeb8f3425d5e9","https://github.com/protocolbuffers/protobuf/blob/v2.6.1/java/core/src/main/java/com/google/protobuf/MessageReflection.java","https://github.com/protocolbuffers/protobuf/blob/v3.0.0/java/core/src/main/java/com/google/protobuf/MessageReflection.java","https://github.com/protocolbuffers/protobuf/tree/main/java"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-g5ww-5jh7-63cx","url":"https://osv.dev/vulnerability/GHSA-g5ww-5jh7-63cx"}],"summary":"Protobuf Java vulnerable to Uncontrolled Resource Consumption"}