CVE-2021-22569

An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated pauses. We recommend upgrading libraries beyond the vulnerable versions.

• CWE-696

• http://www.openwall.com/lists/oss-security/2022/01/12/4Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2022/01/12/7Mailing List, Third Party Advisory
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39330Exploit, Issue Tracking, Mailing List, Vendor Advisory
• https://cloud.google.com/support/bulletins#gcp-2022-001Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2023/04/msg00019.html
• https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2022/01/12/4Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2022/01/12/7Mailing List, Third Party Advisory
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39330Exploit, Issue Tracking, Mailing List, Vendor Advisory
• https://cloud.google.com/support/bulletins#gcp-2022-001Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2023/04/msg00019.html
• https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory

Published

Jan 10, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-22563Invalid JPEG XL images using libjxl can cause an out of boun…4.4
• CVE-2021-22564For certain valid JPEG XL images with a size slightly larger…5.5
• CVE-2021-22565An attacker could prematurely expire a verification code, ma…6.5
• CVE-2021-22566An incorrect setting of UXN bits within mmu_flags_to_s1_pte_…9.8
• CVE-2021-22567Bidirectional Unicode text can be interpreted and compiled d…3.5
• CVE-2021-22568When using the dart pub publish command to publish a package…8.8
• CVE-2021-2257Vulnerability in the Oracle Storage Cloud Software Appliance…4.1
• CVE-2021-22570Nullptr dereference when a null char is present in a proto s…5.5
• CVE-2021-22571A local attacker could read files from some other users' SA3…5.5
• CVE-2021-22572On unix-like systems, the system temporary directory is shar…5.5
• CVE-2021-22573The vulnerability is that IDToken verifier does not verify i…7.3
• CVE-2021-2258Vulnerability in the Oracle Projects product of Oracle E-Bus…8.1