CVE-2021-22569: Denial of Service of protobuf-java parsing procedure

Security readout for executives and security teams

CVE-2021-22569 is a denial-of-service issue in protobuf parsing for Java, Kotlin, and the JRuby gem. A small malicious protobuf payload can keep a parser busy for minutes, potentially making affected services slow or unavailable. The source bundle recommends upgrading beyond vulnerable library versions. Exposure is most likely in Java, Kotlin, or JRuby applications that parse protobuf data from untrusted network, partner, queue, file, or API inputs. The bundle does not provide exact affected version ranges, so dependency inventory and vendor package guidance are required. High for externally reachable or business-critical services using protobuf. The issue targets availability rather than data theft, but unauthenticated network denial of service can still disrupt operations. Act through dependency inventory and library updates. Mitigation focus: Inventory protobuf-java, protobuf-kotlin, and google-protobuf JRuby dependencies, including transitive dependencies.; Upgrade protobuf libraries beyond vulnerable versions as vendor guidance recommends.; Check Google, distribution, and platform advisories for exact fixed package versions..

Prepared

May 24, 2026, 02:44 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.