EUVD-2026-85559

Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.1 and 7.0.0-alpha04, Wire's Swift runtime ProtoReader.skipGroupexpectedEndTag:unknownFieldsWriter: accepts a negative length for a LENGTHDELIMITED field inside an unknown STARTGROUP field...

CVE-2026-61695

The Wire Swift runtime (wire-runtime-swift) is vulnerable to a Denial of Service attack because ProtoReader.skipGroup() fails to reject negative lengths for LENGTH_DELIMITED fields within unknown START_GROUP fields. A crafted 10-byte protobuf payload can cause ReadBuffer.readData(count:) to pass ...

CVE-2026-61695 Wire Swift runtime: negative LENGTH_DELIMITED length in skipGroup() crashes any protobuf-decoding service

Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.1 and 7.0.0-alpha04, Wire's Swift runtime ProtoReader.skipGroupexpectedEndTag:unknownFieldsWriter: accepts a negative length for a LENGTHDELIMITED field inside an unknown STARTGROUP field...

CVE-2026-61695 Wire Swift runtime: negative LENGTH_DELIMITED length in skipGroup() crashes any protobuf-decoding service

Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.1 and 7.0.0-alpha04, Wire's Swift runtime ProtoReader.skipGroupexpectedEndTag:unknownFieldsWriter: accepts a negative length for a LENGTHDELIMITED field inside an unknown STARTGROUP field...

php: php: Denial of Service via out-of-bounds read in mysqlnd wire protocol parser

A flaw was found in PHP. The MySQL Native Driver mysqlnd wire protocol parser fails to verify that an incoming packet contains enough bytes before reading its fields. A malicious or compromised database server can send a truncated packet, causing the client application to read past the buffer...

Wire Swift runtime: negative LENGTH_DELIMITED length in skipGroup() crashes any protobuf-decoding service

Wire's Swift runtime Wire SPM/CocoaPods product, implemented by wire-runtime-swift did not reject a negative LENGTHDELIMITED field length while skipping an unknown protobuf group. A crafted 10-byte protobuf payload could cause ProtoReader.skipGroup to read a length-delimited field whose varint...

CVE-2026-61695: Improper Validation of Array Index

Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.1 and 7.0.0-alpha04, Wire's Swift runtime ProtoReader.skipGroupexpectedEndTag:unknownFieldsWriter: accepts a negative length for a LENGTHDELIMITED field inside an unknown STARTGROUP field...

com.squareup.wire/wire-runtime: com.squareup.wire/wire-runtime-jvm: Wire: Remote Denial of Service due to improper protobuf length validation

A flaw was found in Wire, a library used for gRPC and protocol buffers. In the wire-runtime component, a remote attacker can exploit improper validation of a length-delimited field. By sending a crafted protobuf message with a negative length, the system attempts to access an invalid memory...

CVE-2026-94540

creationtimestamp| type| source ---|---|--- 2026-09-22 00:01:44+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mw2wdagac52e 2026-10-07 03:01:28+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mxaxeh7tbb2m 2026-10-07 03:01:30+00:00| seen|...

CVE-2026-94626

creationtimestamp| type| source ---|---|--- 2026-09-21 23:03:08+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mw2t2go2722e 2026-10-05 15:00:47+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117388897434222843...

CVE-2026-73512

creationtimestamp| type| source ---|---|--- 2026-09-21 21:03:26+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mw2meffgdh2m...

CVE-2026-73550

creationtimestamp| type| source ---|---|--- 2026-09-21 21:03:11+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mw2mdvzic22k...

CVE-2026-69184

creationtimestamp| type| source ---|---|--- 2026-09-21 06:04:46+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvz25hb7jp22 2026-09-23 20:40:20+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117322285943580932 2026-09-23 21:00:03+00:00| seen|...

CVE-2026-81180

creationtimestamp| type| source ---|---|--- 2026-09-21 06:04:39+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvz25a3h7x24 2026-09-23 16:00:09+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mw74dwn4oz2n 2026-09-23 16:00:11+00:00| seen|...

CVE-2026-61714

creationtimestamp| type| source ---|---|--- 2026-09-20 21:01:40+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvy3sbleyv2w 2026-09-24 12:20:39+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117325983788489404 2026-09-24 12:30:10+00:00| seen|...

CVE-2026-81656

creationtimestamp| type| source ---|---|--- 2026-09-20 18:01:27+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvxrpuoc2p2m...

CVE-2026-81626

creationtimestamp| type| source ---|---|--- 2026-09-20 17:04:32+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvxokbui322o 2026-09-25 15:00:11+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117332273205085866 2026-09-25 15:00:28+00:00| seen|...

CVE-2026-87839

creationtimestamp| type| source ---|---|--- 2026-09-20 17:04:16+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvxojsohy52z...

CVE-2026-85017

creationtimestamp| type| source ---|---|--- 2026-09-20 16:01:51+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvxl27c6qg2w...

CVE-2026-94056

creationtimestamp| type| source ---|---|--- 2026-09-20 00:01:34+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvvvf3lxwo2o 2026-09-20 11:06:59+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117303044917613778...