{"action":"Upgrade com.google.protobuf:protobuf-kotlin-lite to 3.16.3 (3.16.x), 3.19.6 (3.19.x), 3.20.3 (3.20.x) or 3.21.7 (3.21.x) or later.","affected":[{"fixed":"3.21.7","introduced":"3.21.0-rc-1"},{"fixed":"3.20.3","introduced":"3.20.0-rc-1"},{"fixed":"3.19.6","introduced":"3.17.0-rc-1"},{"fixed":"3.16.3","introduced":"0"}],"component":"com.google.protobuf:protobuf-kotlin-lite","cve_ids":["CVE-2022-3171"],"ecosystem":"Maven","epss":0.01278,"exploited":false,"fixed_versions":["3.21.7","3.20.3","3.19.6","3.16.3"],"ghsa_id":"GHSA-h4h5-3hr4-j3g2","id":"tcs_01M5N8ZMX48SS5KHXEDXKQ8TX2","modified_at":"2026-09-10T03:49:50.454391245Z","published_at":"2022-10-04T22:17:15Z","references":["https://osv.dev/vulnerability/GHSA-h4h5-3hr4-j3g2","https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-h4h5-3hr4-j3g2","https://nvd.nist.gov/vuln/detail/CVE-2022-3171","https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48771","https://github.com/protocolbuffers/protobuf","https://github.com/protocolbuffers/protobuf/releases/tag/v21.7","https://github.com/protocolbuffers/protobuf/releases/tag/v3.16.3","https://github.com/protocolbuffers/protobuf/releases/tag/v3.19.6","https://github.com/protocolbuffers/protobuf/releases/tag/v3.20.3","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/google-protobuf/CVE-2022-3171.yml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CBAUKJQL6O4TIWYBENORSY5P43TVB4M3","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MPCGUT3T5L6C3IDWUPSUO22QDCGQKTOP","https://security.gentoo.org/glsa/202301-09"],"severity":{"label":"medium","score":5.7},"sources":[{"source":"osv","source_id":"GHSA-h4h5-3hr4-j3g2#Maven/com.google.protobuf:protobuf-kotlin-lite","url":"https://osv.dev/vulnerability/GHSA-h4h5-3hr4-j3g2"}],"summary":"protobuf-java has a potential Denial of Service issue"}