PT-2026-42032 · Maven+3 · Com.Squareup.Wire:Wire-Runtime+3
CVE-2026-45799
·
Published
2026-05-19
·
Updated
2026-07-20
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
wire-runtime versions prior to 6.3.0
wire-runtime-jvm versions 5.3.1 and 5.3.3
Wire 7 alpha versions prior to 7.0.0-alpha03
Description
In the
wire-runtime component, the ByteArrayProtoReader32.skipGroup() and ProtoReader.skipGroup() functions fail to validate that a LENGTH DELIMITED field length is non-negative before calling the skip() function. An attacker can provide a crafted protobuf varint encoding -128 as a signed Int, causing the internal position counter to underflow to a negative value. Consequently, the subsequent call to readByte() accesses the source at an invalid negative position, triggering an ArrayIndexOutOfBoundsException. Because ProtoAdapter.decode(byte[]) is documented to throw IOException, this unchecked runtime exception can bypass error handling and crash services that decode untrusted protobuf payloads.Recommendations
Update wire-runtime to version 6.3.0 or later.
Migrate wire-runtime-jvm to wire-runtime version 6.3.0 or later.
Update Wire 7 alpha to version 7.0.0-alpha03 or later.
Exploit
Fix
Improper Validation of Array Index
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Com.Squareup.Wire:Wire-Runtime
Com.Squareup.Wire:Wire-Runtime-Jvm
Grpc
Wire