CVE-2026-45799

Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.3.0 and 7.0.0-alpha03, ByteArrayProtoReader32.skipGroup and ProtoReader.skipGroup in wire-runtime do not validate that a LENGTHDELIMITED field length is non-negative before skip, allowing a crafted protobuf...

com.squareup.wire:com.squareup.wire.gradle.plugin (5.0.0-alpha01), com.squareup.wire:wire-compiler (5.0.0-alpha01) +11 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime-jvm (5.0.0-alpha01)

com.squareup.wire:wire-runtime-jvm MAVEN version 5.0.0-alpha01 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime-jvm and may be impacted: - com.squareup.wire:com.squareup.wire.gradle.plugin 5.0.0-alpha01 -...

com.squareup.misk:misk (>=2025.08.07.142709-b2b6e6c, <=2025.08.08.100635-5aa9c39), com.squareup.misk:misk-admin (>=2025.08.07.142709-b2b6e6c, <=2025.08.08.100635-5aa9c39) +27 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime (5.3.7)

com.squareup.wire:wire-runtime MAVEN version 5.3.7 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.misk:misk =2025.08.07.142709-b2b6e6c, =2025.08.07.142709-b2b6e6c,...

ai.pipestream:account-manager (0.0.22), ai.pipestream:account-service (>=0.0.2, <=0.0.18) +55 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime (5.3.3)

com.squareup.wire:wire-runtime MAVEN version 5.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - ai.pipestream:account-manager 0.0.22 - ai.pipestream:account-service =0.0.2, =0.1.1, =0.2.7, =0.2.7...

com.cloudflare.realtimekit:core (>=0.1.0, <=1.1.0), com.cloudflare.realtimekit:mobile-core-bridge (>=1.5.0, <=1.5.6) +6 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime (4.7.2)

com.squareup.wire:wire-runtime MAVEN version 4.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.cloudflare.realtimekit:core =0.1.0, =1.5.0, =0.0.1, =1.19.16, =1.0.1, =1.2.1, =1.4.1 Source cve...

com.squareup.wire:wire-grpc-client (4.9.8), com.squareup.wire:wire-schema (4.9.8) +2 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime (4.9.8)

com.squareup.wire:wire-runtime MAVEN version 4.9.8 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.9.8 - com.squareup.wire:wire-schema 4.9.8 -...

com.squareup.wire:wire-grpc-client (4.9.2), com.squareup.wire:wire-schema (4.9.2) +4 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime (4.9.2)

com.squareup.wire:wire-runtime MAVEN version 4.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.9.2 - com.squareup.wire:wire-schema 4.9.2 -...

com.squareup.misk:misk (>=2025.08.14.100953-8889244, <=2025.08.18.214050-a3aad47), com.squareup.misk:misk-admin (>=2025.08.14.100953-8889244, <=2025.08.18.214050-a3aad47) +28 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime (5.3.10)

com.squareup.wire:wire-runtime MAVEN version 5.3.10 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.misk:misk =2025.08.14.100953-8889244, =2025.08.14.100953-8889244,...

com.squareup.wire:wire-grpc-client (4.0.0-alpha.8), com.squareup.wire:wire-schema (4.0.0-alpha.8) potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime (4.0.0-alpha.8)

com.squareup.wire:wire-runtime MAVEN version 4.0.0-alpha.8 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.0.0-alpha.8 - com.squareup.wire:wire-schema...

com.squareup.misk:misk (0.20.0), com.squareup.misk:misk-admin (0.20.0) +45 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime (4.0.0-alpha.7)

com.squareup.wire:wire-runtime MAVEN version 4.0.0-alpha.7 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.misk:misk 0.20.0 - com.squareup.misk:misk-admin 0.20.0 -...

androidx.benchmark:benchmark-common (>=1.2.0-alpha16, <=1.3.0-alpha01), androidx.benchmark:benchmark-junit4 (>=1.2.0-alpha16, <=1.2.4) +5 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime (4.7.0)

com.squareup.wire:wire-runtime MAVEN version 4.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - androidx.benchmark:benchmark-common =1.2.0-alpha16, =1.2.0-alpha16, =1.2.0-alpha16, =1.2.0-alpha16,...

com.squareup.wire:wire-grpc-client (4.1.0), com.squareup.wire:wire-schema (4.1.0) potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime (4.1.0)

com.squareup.wire:wire-runtime MAVEN version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.1.0 - com.squareup.wire:wire-schema 4.1.0 Source cves:...

com.squareup.wire:wire-grpc-client (4.0.0-alpha.20), com.squareup.wire:wire-schema (4.0.0-alpha.20) potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime (4.0.0-alpha.20)

com.squareup.wire:wire-runtime MAVEN version 4.0.0-alpha.20 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.0.0-alpha.20 - com.squareup.wire:wire-schema...

com.squareup.misk:misk (>=2025.08.08.120309-f9b3da6, <=2025.08.13.204324-d02481c), com.squareup.misk:misk-admin (>=2025.08.08.120309-f9b3da6, <=2025.08.13.204324-d02481c) +27 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime (5.3.8)

com.squareup.wire:wire-runtime MAVEN version 5.3.8 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.misk:misk =2025.08.08.120309-f9b3da6, =2025.08.08.120309-f9b3da6,...

com.squareup.wire:com.squareup.wire.gradle.plugin (>=7.0.0-alpha01, <=7.0.0-alpha02), com.squareup.wire:wire-compiler (>=7.0.0-alpha01, <=7.0.0-alpha02) +11 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime-jvm (>=7.0.0-alpha01, <=7.0.0-alpha02)

com.squareup.wire:wire-runtime-jvm MAVEN version =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha02 Source...

ai.looktech.ltrpc.schema:app-server-android (>=1.7.0, <=1.7.1), ai.looktech.ltrpc.schema:app-server-jvm (>=1.7.0, <=1.7.1) +54 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime-jvm (5.5.0)

com.squareup.wire:wire-runtime-jvm MAVEN version 5.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime-jvm and may be impacted: - ai.looktech.ltrpc.schema:app-server-android =1.7.0, =1.7.0, =1.7.0, =1.7.0, =0.34.0, =0.34....

com.squareup.misk.schema-migrator:com.squareup.misk.schema-migrator.gradle.plugin (>=2025.08.08.120309-f9b3da6, <=2025.08.13.204324-d02481c), com.squareup.misk.vitess.vitess-database:com.squareup.misk.vitess.vitess-database.gradle.plugin (>=2025.08.08.120309-f9b3da6, <=2025.08.13.204324-d02481c) +56 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime-jvm (5.3.8)

com.squareup.wire:wire-runtime-jvm MAVEN version 5.3.8 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime-jvm and may be impacted: - com.squareup.misk.schema-migrator:com.squareup.misk.schema-migrator.gradle.plugin...

com.squareup.misk.schema-migrator:com.squareup.misk.schema-migrator.gradle.plugin (>=2025.08.05.111709-c1791a4, <=2025.08.06.225110-5b65cb9), com.squareup.misk.vitess.vitess-database:com.squareup.misk.vitess.vitess-database.gradle.plugin (>=2025.08.05.111709-c1791a4, <=2025.08.06.225110-5b65cb9) +56 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime-jvm (5.3.6)

com.squareup.wire:wire-runtime-jvm MAVEN version 5.3.6 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime-jvm and may be impacted: - com.squareup.misk.schema-migrator:com.squareup.misk.schema-migrator.gradle.plugin...

com.squareup.wire:com.squareup.wire.gradle.plugin (5.0.0-alpha04), com.squareup.wire:wire-compiler (5.0.0-alpha04) +12 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime-jvm (5.0.0-alpha04)

com.squareup.wire:wire-runtime-jvm MAVEN version 5.0.0-alpha04 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime-jvm and may be impacted: - com.squareup.wire:com.squareup.wire.gradle.plugin 5.0.0-alpha04 -...

com.squareup.misk.schema-migrator:com.squareup.misk.schema-migrator.gradle.plugin (>=2025.06.03.182934-790a8b3, <=2025.06.05.100657-d32f88d), com.squareup.misk.vitess.vitess-database:com.squareup.misk.vitess.vitess-database.gradle.plugin (>=2025.06.03.182934-790a8b3, <=2025.06.05.100657-d32f88d) +52 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime-jvm (5.3.2)

com.squareup.wire:wire-runtime-jvm MAVEN version 5.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime-jvm and may be impacted: - com.squareup.misk.schema-migrator:com.squareup.misk.schema-migrator.gradle.plugin...