High, CVSS 7.5MavenPublished
Wire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding service
CVE-2026-45799 · GHSA-7xpr-hc2w-34m9
- Affected
- Maven com.squareup.wire:wire-runtime-jvm <= 6.2.0; >= 7.0.0-alpha01, <= 7.0.0-alpha02
- Fixed in
- 6.3.07.0.0-alpha03· Vendor fix available
- Issue
- CVE-2026-45799 Maintainer summary Wire's protobuf group-skipping logic did not reject negative lengths before skipping a length-delimited field inside a group. A crafted protobuf payload could cause Wire to throw an unchecked runtime exception during decoding instead of the documented IOException / ProtocolException failure path. This can crash services that decode untrusted protobuf payloads and only handle Wire's documented checked decoding failures. Affected artifacts com.squareup.wire:wire-runtime Affected versions: vulnerable releases before 6.3.0. Patched versions: 6.3.0 and later. Users should upgrade to com.squareup.wire:wire-runtime:6.3.0 or later. com.squareup.wire:wire-runtime-jvm Affected versions: vulnerable releases before 6.3.0. Patched versions: 6.3.0 and later. Users should upgrade to com.squareup.wire:wire-runtime:6.3.0 or later. Wire 7 alpha releases The fix has been merged to master and will be included in the next Wire 7 alpha release. Until that release is…
Recommended action: Upgrade to 7.0.0-alpha03 (pre-release) or 6.3.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.