wire

4 results · Feed

• High 7.5
  CVE-2026-61695

  Wire Swift runtime: negative LENGTH_DELIMITED length in skipGroup() crashes any protobuf-decoding service

  Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.1 and 7.0.0-alpha04, Wire's Swift runtime ProtoReader.skipGroup(expectedEndTag:unknownFieldsWriter:) accepts a negative length for a LENGTH_DELIMITED field inside an un…

  square wire github.com/square/wire SwiftURL
  Sep 23, 2026
• High 7.5
  CVE-2026-63126

  Wire: Unauthenticated decoder crash via 32-bit length integer overflow in ByteArrayProtoReader32 (incomplete fix of CVE-2026-45799)

  Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.5 and 7.0.0-alpha04, Wire protobuf readers do not consistently validate attacker-controlled lengths against the current logical message boundary before advancing cursor…

  square wire com.squareup.wire:wire-runtime Maven
  Sep 16, 2026
• High 7.5
  CVE-2026-45799

  Wire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding service

  Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.3.0 and 7.0.0-alpha03, ByteArrayProtoReader32.skipGroup() and ProtoReader.skipGroup() in wire-runtime do not validate that a LENGTH_DELIMITED field length is non-negative…

  square wire grpc com.squareup.wire:wire-runtime Ubuntu Maven
  Jul 17, 2026
• Medium 5.8
  CVE-2024-58103

  Wire has Uncontrolled Recursion on Nested Groups

  Square Wire before 5.2.0 does not enforce a recursion limit on nested groups in ByteArrayProtoReader32.kt and ProtoReader.kt.

  square wire com.squareup.wire:wire-runtime Maven
  Mar 16, 2025