CVE-2022-3171 - Denial of Service

Severity: None2022-11-21

Security Advisories


A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses.

The Oxygen products incorporate protobuf as a third-party library. This advisory was opened to address the potential impact of this third-party library vulnerability.

Affected Products/Versions

ProductSeverityFixed Release Availability
Oxygen XML Web Author v25.0None Oxygen XML Web Author build 2022111708





Severity: High

CVSS Score: 7.5

The protobuf third-party library used by Oxygen XML products is an affected version mentioned in CVE-2022-3171 vulnerability description. However, the Oxygen products does not read arbitrary data in protobuf format. For that reason, Oxygen XML products are not affected by this vulnerability.

Starting with Oxygen XML Web Author v25.0.0.1 build 2022111708 protobuf library was updated to a newer version which fixes this vulnerability.

List of Security Advisories