Wire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding service

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

• CVE-2026-45799: 0.73% estimated exploitation activity in the next 30 days; percentile 54.23 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

CVE-2026-45799 Maintainer summary Wire's protobuf group-skipping logic did not reject negative lengths before skipping a length-delimited field inside a group. A crafted protobuf payload could cause Wire to throw an unchecked runtime exception during decoding instead of the documented IOException / ProtocolException failure path. This can crash services that decode untrusted protobuf payloads and only handle Wire's documented checked decoding failures. Affected artifacts com.squareup.wire:wire-runtime Affected versions: vulnerable releases before 6.3.0. Patched versions: 6.3.0 and later. Users should upgrade to com.squareup.wire:wire-runtime:6.3.0 or later. com.squareup.wire:wire-runtime-jvm Affected versions: vulnerable releases before 6.3.0. Patched versions: 6.3.0 and later. Users should upgrade to com.squareup.wire:wire-runtime:6.3.0 or later. Wire 7 alpha releases The fix has been merged to master and will be included in the next Wire 7 alpha release. Until that release is…

Published by the source

19 May 2026, 19:54 UTC

Last modified by the source

5 Aug 2026, 14:55 UTC

Source last checked

26 Oct 2026, 16:54 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-7xpr-hc2w-34m9

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-45799

Advisory: Wire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding service
IDs: CVE-2026-45799, GHSA-7xpr-hc2w-34m9
Record: https://patchnext.com/advisories/cve-2026-45799 (revision 1, source checked 26 Oct 2026, 16:54 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: High (CVSS 7.5)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: com.squareup.wire:wire-runtime 7.0.0-alpha03, 6.3.0; com.squareup.wire:wire-runtime-jvm 7.0.0-alpha03, 6.3.0. A vendor fix does not mean a deployment is fixed.

## Affected components
- Maven com.squareup.wire:wire-runtime: affected <= 6.2.0; >= 7.0.0-alpha01, <= 7.0.0-alpha02; fixed in 6.3.0, 7.0.0-alpha03
- Maven com.squareup.wire:wire-runtime-jvm: affected <= 6.2.0; >= 7.0.0-alpha01, <= 7.0.0-alpha02; fixed in 6.3.0, 7.0.0-alpha03

## Suggested inspection (read-only)
- Maven com.squareup.wire:wire-runtime: check the installed version with your package manager.
- Maven com.squareup.wire:wire-runtime-jvm: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on com.squareup.wire:wire-runtime, com.squareup.wire:wire-runtime-jvm.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-7xpr-hc2w-34m9 (GitHub-reviewed advisory GHSA-7xpr-hc2w-34m9 lists affected ranges: Maven com.squareup.wire:wire-runtime >=0 =7.0.0-alpha01 =0 =7.0.0-alpha01 <=7.0.0-alpha02)

Commands are suggestions: review each one before running it.