CVE-2022-3171

High

Advisory

Published 4 Oct 2022In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.011; 65th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 211; of 17,781 indexed, latest versions
Container images: 206; deployed by those charts
Fix available: 4 of 5; affected packages

protobuf-java has a potential Denial of Service issue

Carried by container images the latest versions of 211 of 17,781 indexed charts deploy, on 206 images.

Affected package	Affected versions	Fixed in	Images
protobufdeb	2.6.1-1.3, 3.0.0-9, 3.0.0-9.1ubuntu1, 3.0.0-9.1ubuntu1.1+3 more	no fix listed	15
protobuf-javamaven	2.4.1, 2.5.0, 2.6.0, 2.6.1+39 more	3.16.3, 3.19.6, 3.20.3, 3.21.7	186
google-protobufgem	3.8.0	3.16.3	4
protobuf-javalitemaven	3.11.4, 3.18.0, 3.19.4	3.16.3, 3.19.6	4
protobuf-kotlinmaven	3.19.4	3.19.6	3

OSV records: UBUNTU-CVE-2022-3171 GHSA-h4h5-3hr4-j3g2

Charts affected

211 by stars

Chart

Latest

Affected images

Radar Score

streamastreama

1.0.1

1 of 2 See more

streama streama 1.0.1

1 of the 2 container images this version deploys carry CVE-2022-3171.

Container image	Digest	Package	Fixed in
just1not2/streama :1.10.4	8a2305192dec	protobuf-java@2.5.0	3.16.3

Open the chart page →

8,554

zipkin-gcpt3n

1.0.0

1 of 1 See more

zipkin-gcp t3n 1.0.0

1 of the 1 container images this version deploys carry CVE-2022-3171.

Container image	Digest	Package	Fixed in
openzipkin/zipkin-gcp :0.15.2	b5d51d1144e2	protobuf-java@3.9.1	3.16.3

Open the chart page →

4,538

hadoop-deploymenttejaswita-hadoop-helmchart

1.0.0

1 of 1 See more

hadoop-deployment tejaswita-hadoop-helmchart 1.0.0

1 of the 1 container images this version deploys carry CVE-2022-3171.

Container image	Digest	Package	Fixed in
apache/hadoop :3	af361b20bec0	protobuf-java@2.5.0	3.16.3

Open the chart page →

4,240

shenyutest-helm

2.4.21

2 of 2 See more

shenyu test-helm 2.4.21

2 of the 2 container images this version deploys carry CVE-2022-3171.

Container image	Digest	Package	Fixed in
apache/shenyu-admin :2.4.2	e8b7c4ddd069	protobuf-java@3.8.0	3.16.3
apache/shenyu-bootstrap :2.4.2	0bd3b25c4be4	protobuf-java@3.8.0	3.16.3

Open the chart page →

12,513

thingsboardthingsboard

0.1.3

4 of 12 See more

thingsboard thingsboard 0.1.3

4 of the 12 container images this version deploys carry CVE-2022-3171.

Container image	Digest	Package	Fixed in
thingsboard/tb-coap-transport :3.4.1	bd45a09d85d9	protobuf-java@3.17.2	3.19.6
thingsboard/tb-http-transport :3.4.1	a06f53c5e2da	protobuf-java@3.17.2	3.19.6
thingsboard/tb-mqtt-transport :3.4.1	030f316ce301	protobuf-java@3.17.2	3.19.6
thingsboard/tb-node :3.4.1	645f43b688f7	protobuf-java@3.17.2	3.19.6

Open the chart page →

25,394

hermestouk

0.6.0

1 of 3 See more

hermes touk 0.6.0

1 of the 3 container images this version deploys carry CVE-2022-3171.

Container image	Digest	Package	Fixed in
apicurio/apicurio-registry-kafkasql :2.1.0.Final	a97d67487532	protobuf-java@3.18.0	3.19.6

Open the chart page →

12,455

drillwearefrank

1.3.6

1 of 3 See more

drill wearefrank 1.3.6

1 of the 3 container images this version deploys carry CVE-2022-3171.

Container image	Digest	Package	Fixed in
apache/drill :1.21.1	1f96558fd292	protobuf-java@2.5.0	3.16.3

Open the chart page →

9,397

sonarqubewebencryptor

6.7.3

1 of 3 See more

sonarqube webencryptor 6.7.3

1 of the 3 container images this version deploys carry CVE-2022-3171.

Container image	Digest	Package	Fixed in
library/sonarqube :8.2-community	a246bc64207e	protobuf-java@3.8.0	3.16.3

Open the chart page →

5,460

webhookie-allwebhookie

0.1.2

1 of 3 See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2022-3171.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :14.0.0	3029dc0f1d38	protobuf-java@3.12.2	3.16.3

Open the chart page →

28,605

apicurio-registry-sqlwitcom-gmbh

0.1.0

1 of 1 See more

apicurio-registry-sql witcom-gmbh 0.1.0

1 of the 1 container images this version deploys carry CVE-2022-3171.

Container image	Digest	Package	Fixed in
apicurio/apicurio-registry-jpa :1.3.2.Final	44eeddd3562c	protobuf-java@3.13.0	3.16.3

Open the chart page →

3,424

opendistro-eswitcom-gmbh

1.13.3

1 of 3 See more

opendistro-es witcom-gmbh 1.13.3

1 of the 3 container images this version deploys carry CVE-2022-3171.

Container image	Digest	Package	Fixed in
amazon/opendistro-for-elasticsearch :1.13.3	2acfa1dcc5f8	protobuf-java@3.11.0	3.16.3

Open the chart page →

5,806

Container images carrying it

206 by charts deploying them

A fixed version is listed for 4 of the 5 affected packages.

Container image	Digest	Package	Fixed in	Used by
apache/shenyu-admin :2.5.1	e2be712fc4f4	protobuf-java@3.12.0	3.16.3	1
apache/shenyu-bootstrap :2.5.1	1bd5756f6273	protobuf-java@3.15.3	3.16.3	1
apache/skywalking-oap-server :9.2.0	133d35d2c263	protobuf-java@3.19.4	3.19.6	1
apache/skywalking-oap-server :8.1.0-es7	641237e0299b	protobuf-java@3.11.4	3.16.3	1
apache/skywalking-oap-server :8.9.1	b4ec8c18d079	protobuf-java@3.17.3	3.19.6	1
apicurio/apicurio-registry-jpa :1.3.2.Final	44eeddd3562c	protobuf-java@3.13.0	3.16.3	1
apicurio/apicurio-registry-kafkasql :2.1.0.Final	a97d67487532	protobuf-java@3.18.0	3.19.6	1
arturisimo/planner :v1.0	fff9de644941	protobuf-java@3.10.0	3.16.3	1
assistiot/automated_configuration :latest	23f195a7a26a	protobuf-java@3.7.0	3.16.3	1
assistiot/cybersecurity-monitoring_id-elk :latest	ba1d85ec3739	protobuf-java@3.11.0	3.16.3	1
assistiot/cybersecurity-monitoring_ir-thv :latest	c8b6c7eaa0cd	protobuf-java@2.5.0	3.16.3	1
assistiot/identity-manager_kc :latest	0df4b4fa899a	protobuf-java@3.19.2	3.19.6	1
assistiot/video_augmentation :runner-cpu-latest	e5ae539ce2cb	protobuf@3.6.1.3-2ubuntu5.2	no fix listed	1
atlassian/jira-software :8.14.0	37bc46cbec1a	protobuf-java@3.0.2	3.16.3	1
bbernhard/signal-cli-rest-api :0.57	549ad08d7e14	protobuf-javalite@3.11.4	3.16.3	1
confluentinc/cp-enterprise-control-center :6.1.0	f2975d507a2a	protobuf-java@3.11.4	3.16.3	1
confluentinc/cp-enterprise-kafka :6.1.0	8f1544df1f48	protobuf-java@3.11.4	3.16.3	1
confluentinc/cp-kafka-connect :6.1.0	4bc70a83ca6f	protobuf-java@3.11.4	3.16.3	1
confluentinc/cp-kafka-rest :6.1.0	b0b7aa26254a	protobuf-java@3.11.4	3.16.3	1
confluentinc/cp-ksqldb-server :6.1.0	ee403d5b9090	protobuf-java@3.11.4	3.16.3	1
confluentinc/cp-schema-registry :6.1.0	b651d4b6185a	protobuf-java@3.11.4	3.16.3	1
datappeal/hive-metastore :latest	e38c085a3567	protobuf-java@2.5.0	3.16.3	1
davidvmar/urjc-davidvmar-worker :1.0.1	0d221e834a21	protobuf-java@3.10.0	3.16.3	1
dbanda/livy :0.8	0ca125e68e53	protobuf-java@2.5.0	3.16.3	1
dbanda/spark :2.4.6	d0e6367876ae	protobuf-java@3.3.0	3.16.3	1
deltaio/delta-sharing-server :0.2.0	8b75118187c5	protobuf-java@3.15.6	3.16.3	1
dremio/dremio-oss :24.1.0	80ed2e3b7c43	protobuf-java@3.7.1	3.16.3	1
duck1123/dinsro :latest	9568c5961d5d	protobuf-java@3.21.1	3.21.7	1
easypi/openrefine :3.7.0	d2950a36a576	protobuf-java@3.19.4	3.19.6	1
egdsandaru/apache-ranger-admin :1.0.0	681baa1926f4	protobuf-java@2.5.0	3.16.3	1
emeraldpay/dshackle :0.14.0	126f0ae0b388	protobuf-java@3.17.2	3.19.6	1
emeraldpay/dshackle :0.12	ac2a4bc66ab6	protobuf-java@3.12.0	3.16.3	1
empathyco/elasticsearch :7.17.2-memlock	03e724e41eeb	protobuf-java@3.16.1	3.16.3	1
expediagroup/pitchfork :1.31	4f2cf61e7de9	protobuf-java@3.18.0	3.19.6	1
farberg/apache-knox-docker :1.6.1	4b4a22487394	protobuf-java@3.14.0	3.16.3	1
fimperato/sparkvid-api :1.0.5-RELEASE	604012b77841	protobuf-java@2.5.0	3.16.3	1
fiware/biz-ecosystem-charging-backend :11.7.0	29456835bb2c	protobuf@3.6.1.3-2ubuntu5.2	no fix listed	1
fiware/biz-ecosystem-logic-proxy :11.20.3	d551a13e8278	protobuf-java@2.5.0	3.16.3	1
fjvela/urjc-fjvela-worker :1.0.1	70cebf67bd66	protobuf-java@3.10.0	3.16.3	1
folioci/mod-marccat :latest	1b57d690d568	protobuf-java@2.6.0	3.16.3	1
fonoster/routr :1.0.0-rc5	2ca65af17cbc	protobuf-java@3.6.1	3.16.3	1
franrobles8/planner :v3.0	99985392d63c	protobuf-java@3.10.0	3.16.3	1
gchq/accumulo :2.0.1	c460bb587d6d	protobuf-java@3.7.1	3.16.3	1
gradiant/hdfs :3.2.2	e3bf364fe713	protobuf-java@2.5.0	3.16.3	1
graylog2/server :2.4.3-3	8ff28c66e6c1	protobuf-java@3.4.0	3.16.3	1
gridgain/community :8.9.11	d32d182a0e6a	protobuf-java@3.5.0	3.16.3	1
gurolakman/oam :4.0.0	ed8fd2062548	protobuf-java@2.5.0	3.16.3	1
hazelcast/hazelcast :5.3.1	8fe26efde8e1	protobuf-java@3.7.1	3.16.3	1
hazelcast/hazelcast-jet :4.5.3	a825ecbe9fda	protobuf-java@3.13.0	3.16.3	1
headwindmdm/hmdm :0.1.9	3550b4840840	protobuf@3.12.4-1ubuntu7.22.04.6	no fix listed	1