https://github.com/firebase/firebase-admin-java/pull/1003 bumps the version of protobuf, where the old version currently gets flagged with a CVE. A new release of firebase-admin with this PR merged (which it already is) should fix this