Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Wire's protobuf decoders did not consistently validate attacker-controlled length-delimited sizes against the current reader bounds before computing cursor, limit, or pointer positions. In the Kotlin runtime, ProtoAdapter.decode(ByteArray) and ProtoAdapter.decode(ByteString) use the ProtoReader32 fast path implemented by ByteArrayProtoReader32. In ByteArrayProtoReader32.internalNextLengthDelimited(), Wire read an untrusted varint length into an Int and rejected only negative values. A length such as 2147483647 is non-negative, so it passed that check, but pos + length overflowed the signed 32-bit cursor and produced a negative limit. The following if (limit pushedLimit) guard did not catch this because the overflowed value was negative. That invalid limit then reached string, bytes, skip, and scalar-reading paths as an invalid byte count or invalid range. Instead of failing as a checked decode error such as IOException, malformed input could throw unchecked runtime exceptions…
Recommended action: Upgrade to 7.0.0-alpha04 (pre-release) or 6.4.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
CVE-2026-45799 Maintainer summary Wire's protobuf group-skipping logic did not reject negative lengths before skipping a length-delimited field inside a group. A crafted protobuf payload could cause Wire to throw an unchecked runtime exception during decoding instead of the documented IOException / ProtocolException failure path. This can crash services that decode untrusted protobuf payloads and only handle Wire's documented checked decoding failures. Affected artifacts com.squareup.wire:wire-runtime Affected versions: vulnerable releases before 6.3.0. Patched versions: 6.3.0 and later. Users should upgrade to com.squareup.wire:wire-runtime:6.3.0 or later. com.squareup.wire:wire-runtime-jvm Affected versions: vulnerable releases before 6.3.0. Patched versions: 6.3.0 and later. Users should upgrade to com.squareup.wire:wire-runtime:6.3.0 or later. Wire 7 alpha releases The fix has been merged to master and will be included in the next Wire 7 alpha release. Until that release is…
Recommended action: Upgrade to 7.0.0-alpha03 (pre-release) or 6.3.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Square Wire before 5.2.0 does not enforce a recursion limit on nested groups in ByteArrayProtoReader32.kt and ProtoReader.kt.
Recommended action: Upgrade to 5.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.