🔐 CVE Alert

CVE-2026-45799

HIGH 7.5

Wire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding service

CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th

Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.3.0 and 7.0.0-alpha03, ByteArrayProtoReader32.skipGroup() and ProtoReader.skipGroup() in wire-runtime do not validate that a LENGTH_DELIMITED field length is non-negative before skip(), allowing a crafted protobuf varint encoding -128 as a signed Int to make skip(-128) move the internal position negative and make the next readByte() throw ArrayIndexOutOfBoundsException instead of the documented IOException or ProtocolException, which can crash services using ProtoAdapter.decode(byte[]) on untrusted payloads. This issue is fixed in versions 6.3.0 and 7.0.0-alpha03.

CWE CWE-129
Vendor square
Product wire
Published Jul 17, 2026
Stay Ahead of the Next One

Get instant alerts for square wire

Be the first to know when new high vulnerabilities affecting square wire are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Affected Versions

square / wire
< 6.3.0 >= 7.0.0-alpha01, < 7.0.0-alpha03

References

NVD ↗ CVE.org ↗ EPSS Data ↗
github.com: https://github.com/square/wire/security/advisories/GHSA-7xpr-hc2w-34m9 github.com: https://github.com/square/wire/pull/3595 github.com: https://github.com/square/wire/pull/3597 github.com: https://github.com/square/wire/commit/47d5b0dba53935d5332cd41a80a353b3fc90e7b0 github.com: https://github.com/square/wire/commit/e4e56fab38a547d9625f05c97f1d8f0bcc3a5773 github.com: https://github.com/square/wire/releases/tag/6.3.0 github.com: https://github.com/square/wire/releases/tag/7.0.0-alpha03