CVE-2022-3171

High

Advisory

Published 4 Oct 2022In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.011; 65th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 211; of 17,781 indexed, latest versions
Container images: 206; deployed by those charts
Fix available: 4 of 5; affected packages

protobuf-java has a potential Denial of Service issue

Carried by container images the latest versions of 211 of 17,781 indexed charts deploy, on 206 images.

Affected package	Affected versions	Fixed in	Images
protobufdeb	2.6.1-1.3, 3.0.0-9, 3.0.0-9.1ubuntu1, 3.0.0-9.1ubuntu1.1+3 more	no fix listed	15
protobuf-javamaven	2.4.1, 2.5.0, 2.6.0, 2.6.1+39 more	3.16.3, 3.19.6, 3.20.3, 3.21.7	186
google-protobufgem	3.8.0	3.16.3	4
protobuf-javalitemaven	3.11.4, 3.18.0, 3.19.4	3.16.3, 3.19.6	4
protobuf-kotlinmaven	3.19.4	3.19.6	3

OSV records: UBUNTU-CVE-2022-3171 GHSA-h4h5-3hr4-j3g2

Charts affected

211 by stars

Chart

Latest

Affected images

Radar Score

streamastreama

1.0.1

1 of 2 See more

streama streama 1.0.1

1 of the 2 container images this version deploys carry CVE-2022-3171.

Container image	Digest	Package	Fixed in
just1not2/streama :1.10.4	8a2305192dec	protobuf-java@2.5.0	3.16.3

Open the chart page →

8,554

zipkin-gcpt3n

1.0.0

1 of 1 See more

zipkin-gcp t3n 1.0.0

1 of the 1 container images this version deploys carry CVE-2022-3171.

Container image	Digest	Package	Fixed in
openzipkin/zipkin-gcp :0.15.2	b5d51d1144e2	protobuf-java@3.9.1	3.16.3

Open the chart page →

4,538

hadoop-deploymenttejaswita-hadoop-helmchart

1.0.0

1 of 1 See more

hadoop-deployment tejaswita-hadoop-helmchart 1.0.0

1 of the 1 container images this version deploys carry CVE-2022-3171.

Container image	Digest	Package	Fixed in
apache/hadoop :3	af361b20bec0	protobuf-java@2.5.0	3.16.3

Open the chart page →

4,240

shenyutest-helm

2.4.21

2 of 2 See more

shenyu test-helm 2.4.21

2 of the 2 container images this version deploys carry CVE-2022-3171.

Container image	Digest	Package	Fixed in
apache/shenyu-admin :2.4.2	e8b7c4ddd069	protobuf-java@3.8.0	3.16.3
apache/shenyu-bootstrap :2.4.2	0bd3b25c4be4	protobuf-java@3.8.0	3.16.3

Open the chart page →

12,513

thingsboardthingsboard

0.1.3

4 of 12 See more

thingsboard thingsboard 0.1.3

4 of the 12 container images this version deploys carry CVE-2022-3171.

Container image	Digest	Package	Fixed in
thingsboard/tb-coap-transport :3.4.1	bd45a09d85d9	protobuf-java@3.17.2	3.19.6
thingsboard/tb-http-transport :3.4.1	a06f53c5e2da	protobuf-java@3.17.2	3.19.6
thingsboard/tb-mqtt-transport :3.4.1	030f316ce301	protobuf-java@3.17.2	3.19.6
thingsboard/tb-node :3.4.1	645f43b688f7	protobuf-java@3.17.2	3.19.6

Open the chart page →

25,394

hermestouk

0.6.0

1 of 3 See more

hermes touk 0.6.0

1 of the 3 container images this version deploys carry CVE-2022-3171.

Container image	Digest	Package	Fixed in
apicurio/apicurio-registry-kafkasql :2.1.0.Final	a97d67487532	protobuf-java@3.18.0	3.19.6

Open the chart page →

12,455

drillwearefrank

1.3.6

1 of 3 See more

drill wearefrank 1.3.6

1 of the 3 container images this version deploys carry CVE-2022-3171.

Container image	Digest	Package	Fixed in
apache/drill :1.21.1	1f96558fd292	protobuf-java@2.5.0	3.16.3

Open the chart page →

9,397

sonarqubewebencryptor

6.7.3

1 of 3 See more

sonarqube webencryptor 6.7.3

1 of the 3 container images this version deploys carry CVE-2022-3171.

Container image	Digest	Package	Fixed in
library/sonarqube :8.2-community	a246bc64207e	protobuf-java@3.8.0	3.16.3

Open the chart page →

5,460

webhookie-allwebhookie

0.1.2

1 of 3 See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2022-3171.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :14.0.0	3029dc0f1d38	protobuf-java@3.12.2	3.16.3

Open the chart page →

28,605

apicurio-registry-sqlwitcom-gmbh

0.1.0

1 of 1 See more

apicurio-registry-sql witcom-gmbh 0.1.0

1 of the 1 container images this version deploys carry CVE-2022-3171.

Container image	Digest	Package	Fixed in
apicurio/apicurio-registry-jpa :1.3.2.Final	44eeddd3562c	protobuf-java@3.13.0	3.16.3

Open the chart page →

3,424

opendistro-eswitcom-gmbh

1.13.3

1 of 3 See more

opendistro-es witcom-gmbh 1.13.3

1 of the 3 container images this version deploys carry CVE-2022-3171.

Container image	Digest	Package	Fixed in
amazon/opendistro-for-elasticsearch :1.13.3	2acfa1dcc5f8	protobuf-java@3.11.0	3.16.3

Open the chart page →

5,806

Container images carrying it

206 by charts deploying them

A fixed version is listed for 4 of the 5 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/star-whale/server :0.6.15	8368359c8dd0	protobuf-java@3.21.2	3.21.7	1
ghcr.io/streamingfast/substreams-sink-kv :v2.3.0	26953ec68d5d	protobuf@3.6.1.3-2ubuntu5.2	no fix listed	1
ghcr.io/streamingfast/substreams-sink-noop :v1.4.0	d7c43c3135c6	protobuf@3.6.1.3-2ubuntu5.2	no fix listed	1
public.ecr.aws/v0r6c2e2/hive-metastore :latest	794b3bff9510	protobuf-java@3.7.1	3.16.3	1
quay.io/fiware/waltid :1.14.1-SNAPSHOT	93889c3d8a34	protobuf-java@3.19.3 protobuf-javalite@3.18.0	3.19.6 3.19.6	1
quay.io/keycloak/keycloak :14.0.0	3029dc0f1d38	protobuf-java@3.12.2	3.16.3	1