https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T20:33:24.244467+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2022-06396 bdu:2022-06396 2026-10-02T20:33:25.044591+00:00 bdu:2022-06396 https://cve.radiocsirt.org/vuln/bell-cve-2022-3171 Withdrawn: BELL-CVE-2022-3171 — CVE-2022-3171 does not affect BellSoft software 2026-10-02T20:33:25.044650+00:00

Withdrawn by the publisher.

https://cve.radiocsirt.org/vuln/certfr-2023-avi-0034 certfr-2023-avi-0034 — De multiples vulnérabilités ont été découvertes dans les produits Oracle. Certaines d'entre elles permettent à un attaq… 2026-10-02T20:33:25.044670+00:00 certfr-2023-avi-0034 https://cve.radiocsirt.org/vuln/cleanstart-2026-cu18187 Withdrawn: CLEANSTART-2026-CU18187 — Security fixes in stargate 1.0.90-r4 2026-10-02T20:33:25.044687+00:00

Withdrawn by the publisher.

Affected: CleanStart: stargate

Package stargate version 1.0.90-r4 fixes 87 vulnerabilities: ghsa-76h9-2vwh-w278, ghsa-pqr6-cmr2-h8hf, ghsa-fjpj-2g6w-x25r, ghsa-qcwq-55hx-v3vh, ghsa-55g7-9cwv-5qfv...

 https://cve.radiocsirt.org/vuln/euvd-2026-232050 EUVD-2026-232050 2026-10-02T20:33:25.044720+00:00 EUVD-2026-232050 https://cve.radiocsirt.org/vuln/fkie_cve-2022-3171 fkie_cve-2022-3171 2026-10-02T20:33:25.044733+00:00

A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.

 https://cve.radiocsirt.org/vuln/ghsa-h4h5-3hr4-j3g2 GHSA-h4h5-3hr4-j3g2 — protobuf-java has a potential Denial of Service issue 2026-10-02T20:33:25.044756+00:00

Affected: Maven: com.google.protobuf:protobuf-java, Maven: com.google.protobuf:protobuf-kotlin, RubyGems: google-protobuf, Maven: com.google.protobuf:protobuf-javalite, Maven: com.google.protobuf:protobuf-kotlin-lite

## Summary A potential Denial of Service issue in `protobuf-java` core and lite was discovered in the parsing procedure for binary and text format data. Input streams containing multiple instances of non-repeated [embedded messages](http://developers.google.com/protocol-buffers/docs/encoding#embedded) with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses.

Reporter: [OSS Fuzz](https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48771)

Affected versions: This issue affects both the Java full and lite Protobuf runtimes, as well as Protobuf for Kotlin and JRuby, which themselves use the Java Protobuf runtime.

## Severity

[CVE-2022-3171](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3171) Medium - CVSS Score: 5.7 (NOTE: there may be a delay in publication)

## Remediation and Mitigation

Please update to the latest available versions of the following packages:

protobuf-java (3.21.7, 3.20.3, 3.19.6, 3.16.3) protobuf-javalite (3.21.7, 3.20.3, 3.19.6, 3.16.3) protobuf-kotlin (3.21.7, 3.20.3, 3.19.6, 3.16.3) protobuf-kotlin-lite (3.21.7, 3.20.3, 3.19.6, 3.16.3) google-protobuf [JRuby gem only] (3.21.7, 3.20.3, 3.19.6)

 https://cve.radiocsirt.org/vuln/gsd-2022-3171 gsd-2022-3171 2026-10-02T20:33:25.044809+00:00 gsd-2022-3171 https://cve.radiocsirt.org/vuln/msrc_cve-2022-3171 msrc_CVE-2022-3171 — Memory handling vulnerability in ProtocolBuffers Java core and lite 2026-10-02T20:33:25.044822+00:00 msrc_CVE-2022-3171 https://cve.radiocsirt.org/vuln/oesa-2022-2010 OESA-2022-2010 — protobuf security update 2026-10-02T20:33:25.044838+00:00

Affected: openEuler:20.03-LTS-SP1: protobuf

Security Fix(es): A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for protobuf-cpp, and versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 4.21.5 for protobuf-python can lead to out of memory failures. A specially crafted message with multiple key-value per elements creates parsing issues, and can lead to a Denial of Service against services receiving unsanitized input. We recommend upgrading to versions 3.18.3, 3.19.5, 3.20.2, 3.21.6 for protobuf-cpp and 3.18.3, 3.19.5, 3.20.2, 4.21.6 for protobuf-python. Versions for 3.16 and 3.17 are no longer updated.(CVE-2022-1941) A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.(CVE-2022-3171)

 https://cve.radiocsirt.org/vuln/rhsa-2022:7896 RHSA-2022:7896 — Red Hat Security Advisory: Red Hat Integration Debezium 1.9.7 security update 2026-10-02T20:33:25.044866+00:00

protobuf-java: potential DoS in the parsing procedure for binary data protobuf-java: timeout in parser leads to DoS

 https://cve.radiocsirt.org/vuln/suse-su-2023:2783-2 SUSE-SU-2023:2783-2 — Security update for grpc, protobuf, python-Deprecated, python-PyGithub, python-aiocontextvars, python-avro, python-bcry… 2026-10-02T20:33:25.044885+00:00

Security update for grpc, protobuf, python-Deprecated, python-PyGithub, python-aiocontextvars, python-avro, python-bcrypt, python-cryptography, python-cryptography-vectors, python-google-api-core, python-googleapis-common-protos, python-grpcio-gcp, python-humanfriendly, python-jsondiff, python-knack, python-opencensus, python-opencensus-context, python-opencensus-ext-threading, python-opentelemetry-api, python-psutil, python-pytest-asyncio, python-requests, python-websocket-client, python-websockets

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-3171 UBUNTU-CVE-2022-3171 2026-10-02T20:33:25.044910+00:00

Affected: Ubuntu:Pro:14.04:LTS: protobuf, Ubuntu:Pro:16.04:LTS: protobuf, Ubuntu:Pro:18.04:LTS: protobuf, Ubuntu:Pro:20.04:LTS: protobuf, Ubuntu:22.04:LTS: protobuf

A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-2187 WID-SEC-W-2022-2187 — IBM WebSphere Application Server: Mehrere Schwachstellen ermöglichen Denial of Service 2026-10-02T20:33:25.044939+00:00

Ein authentisierter Angreifer im angrenzenden Netzbereich kann mehrere Schwachstellen in IBM WebSphere Application Server ausnutzen, um einen Denial of Service Angriff durchzuführen.