Protobuf Javalite

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:google:protobuf-javalite:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorGoogle (f181d1eb-7269-5bae-b76e-e66ceb214562)
ProductProtobuf Javalite (0b6dce7e-a981-5c29-88b3-9caa432e548e)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from purl2cpe mapping

PURL mappings

PURLSourceLast updated
pkg:deb/debian/protobuf purl2cpe 2026-06-01 10:16:37.593999
pkg:deb/ubuntu/protobuf purl2cpe 2026-06-01 10:16:37.594001
pkg:gem/google-protobuf purl2cpe 2026-06-01 10:16:37.594003
pkg:github/protocolbuffers/protobuf purl2cpe 2026-06-01 10:16:37.594004
pkg:maven/com.google.protobuf/protobuf-javalite purl2cpe 2026-06-01 10:16:37.594005
pkg:pypi/protobuf purl2cpe 2026-06-01 10:16:37.594007
pkg:rpm/centos/protobuf purl2cpe 2026-06-01 10:16:37.594008
pkg:rpm/fedora/protobuf purl2cpe 2026-06-01 10:16:37.594010
pkg:rpm/opensuse/protobuf purl2cpe 2026-06-01 10:16:37.594011
pkg:sourceforge/protocol-buffers.mirror purl2cpe 2026-06-01 10:16:37.594012

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2024-7254 vulnerable 2026-06-08 06:58:21.628990 Stack overflow in Protocol Buffers Java Lite
Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.
Published: 2024-09-19T00:18:45.824Z
Updated: 2025-09-08T09:37:53.702Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-3510 vulnerable 2026-06-08 05:48:21.311028 Parsing issue in protobuf message-type extension
HIGH (7.5)
A parsing issue similar to CVE-2022-3171, but with Message-Type Extensions in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.
Published: 2022-11-11T16:35:20.765Z
Updated: 2025-04-22T15:09:17.050Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-3509 vulnerable 2026-06-08 05:48:21.310254 Parsing issue in protobuf textformat
HIGH (7.5)
A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.
Published: 2022-11-01T18:09:31.634Z
Updated: 2025-04-22T15:10:13.149Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-3171 vulnerable 2026-06-08 05:47:19.613807 Memory handling vulnerability in ProtocolBuffers Java core and lite
MEDIUM (4.3)
A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.
Published: 2022-10-12T00:00:00.000Z
Updated: 2025-04-21T13:47:57.569Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.