com.squareup.wire:wire-grpc-client (4.0.0-alpha.12), com.squareup.wire:wire-schema (4.0.0-alpha.12) potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime (4.0.0-alpha.12)

com.squareup.wire:wire-runtime MAVEN version 4.0.0-alpha.12 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.0.0-alpha.12 - com.squareup.wire:wire-schema...

com.aliyun.rum:alibabacloud-android-rum-sdk (>=0.4.0-beta.1, <=2.0.3), com.squareup.misk:misk (>=2025.03.05.153222-bda057a, <=2025.06.03.161336-a14ce45) +26 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime (5.3.1)

com.squareup.wire:wire-runtime MAVEN version 5.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.aliyun.rum:alibabacloud-android-rum-sdk =0.4.0-beta.1, =2025.03.05.153222-bda057a,...

com.squareup.wire:com.squareup.wire.gradle.plugin (4.0.0-alpha.16), com.squareup.wire:wire-compiler (4.0.0-alpha.16) +12 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime-jvm (4.0.0-alpha.16)

com.squareup.wire:wire-runtime-jvm MAVEN version 4.0.0-alpha.16 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime-jvm and may be impacted: - com.squareup.wire:com.squareup.wire.gradle.plugin 4.0.0-alpha.16 -...

com.squareup.retrofit:converter-wire (>=2.0.0-beta1, <=2.0.0-beta2), com.squareup.wire:wire-compiler (1.7.0) +2 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime (1.7.0)

com.squareup.wire:wire-runtime MAVEN version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.retrofit:converter-wire =2.0.0-beta1, =2.0.0-beta2 - com.squareup.wire:wire-compiler...

app.cash.backfila:backfila-embedded (>=2023.08.14.172409-6d1d2a2, <=2024.08.23.143736-34a2a42), app.cash.backfila:client-base (>=2023.08.14.172409-6d1d2a2, <=2024.08.23.143736-34a2a42) +8 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime (4.4.2)

com.squareup.wire:wire-runtime MAVEN version 4.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - app.cash.backfila:backfila-embedded =2023.08.14.172409-6d1d2a2, =2023.08.14.172409-6d1d2a2,...

com.squareup.misk:misk (2025.08.14.063635-1fd415a), com.squareup.misk:misk-admin (2025.08.14.063635-1fd415a) +27 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime (5.3.9)

com.squareup.wire:wire-runtime MAVEN version 5.3.9 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.misk:misk 2025.08.14.063635-1fd415a - com.squareup.misk:misk-admin...

com.slack.foundry:tracing (>=0.29.1, <=0.30.0), com.squareup.misk.schema-migrator:com.squareup.misk.schema-migrator.gradle.plugin (>=2025.08.07.142709-b2b6e6c, <=2025.08.08.100635-5aa9c39) +57 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime-jvm (5.3.7)

com.squareup.wire:wire-runtime-jvm MAVEN version 5.3.7 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime-jvm and may be impacted: - com.slack.foundry:tracing =0.29.1, =2025.08.07.142709-b2b6e6c, =2025.08.07.142709-b2b6e6c,...

com.squareup.wire:wire-grpc-client (4.4.3), com.squareup.wire:wire-schema (4.4.3) +2 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime (4.4.3)

com.squareup.wire:wire-runtime MAVEN version 4.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.4.3 - com.squareup.wire:wire-schema 4.4.3 - io.dyte:core...

androidx.benchmark:benchmark-common (1.4.0-alpha07), androidx.benchmark:benchmark-macro (1.4.0-alpha07) +80 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime-jvm (5.0.0)

com.squareup.wire:wire-runtime-jvm MAVEN version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime-jvm and may be impacted: - androidx.benchmark:benchmark-common 1.4.0-alpha07 - androidx.benchmark:benchmark-macro...

com.squareup.wire:wire-compiler (2.0.0-beta1), com.squareup.wire:wire-gson-support (2.0.0-beta1) +2 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime (2.0.0-beta1)

com.squareup.wire:wire-runtime MAVEN version 2.0.0-beta1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-compiler 2.0.0-beta1 - com.squareup.wire:wire-gson-support 2.0.0-beta1...

com.squareup.wire:com.squareup.wire.gradle.plugin (4.0.0-alpha.12), com.squareup.wire:wire-compiler (4.0.0-alpha.12) +12 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime-jvm (4.0.0-alpha.12)

com.squareup.wire:wire-runtime-jvm MAVEN version 4.0.0-alpha.12 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime-jvm and may be impacted: - com.squareup.wire:com.squareup.wire.gradle.plugin 4.0.0-alpha.12 -...

com.squareup.wire:wire-grpc-client (4.4.0), com.squareup.wire:wire-schema (4.4.0) potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime (4.4.0)

com.squareup.wire:wire-runtime MAVEN version 4.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.4.0 - com.squareup.wire:wire-schema 4.4.0 Source cves:...

com.squareup.wire:com.squareup.wire.gradle.plugin (4.9.4), com.squareup.wire:wire-compiler (4.9.4) +12 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime-jvm (4.9.4)

com.squareup.wire:wire-runtime-jvm MAVEN version 4.9.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime-jvm and may be impacted: - com.squareup.wire:com.squareup.wire.gradle.plugin 4.9.4 - com.squareup.wire:wire-compiler...

com.squareup.misk:misk (>=0.25.0-20220924.1114-0c6f2d7, <=0.25.0-20230405.1913-51e097f), com.squareup.misk:misk-actions (>=0.25.0-20220924.1114-0c6f2d7, <=0.25.0-20230405.1913-51e097f) +50 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime-jvm (4.4.0)

com.squareup.wire:wire-runtime-jvm MAVEN version 4.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime-jvm and may be impacted: - com.squareup.misk:misk =0.25.0-20220924.1114-0c6f2d7, =0.25.0-20220924.1114-0c6f2d7,...

com.squareup.wire:com.squareup.wire.gradle.plugin (>=7.0.0-alpha01, <=7.0.0-alpha02), com.squareup.wire:wire-compiler (>=7.0.0-alpha01, <=7.0.0-alpha02) +11 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime-jvm (>=7.0.0-alpha01, <=7.0.0-alpha02)

com.squareup.wire:wire-runtime-jvm MAVEN version =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha02 Source...

ai.looktech.ltrpc.schema:app-server (>=2.0.0, <=2.7.0), ai.looktech.ltrpc.schema:bt-server (>=2.0.0, <=2.7.0) +54 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime (>=6.0.0-alpha01, <=6.2.0)

com.squareup.wire:wire-runtime MAVEN version =6.0.0-alpha01, =2.0.0, =2.0.0, =1.5.0-alpha05, =1.5.0-alpha05, =1.5.0-alpha05, =1.0.0-alpha06, =2.0.0-alpha04, =2026.03.19.180705-f87ffc7, =2026.03.19.180705-f87ffc7, =2026.03.19.180705-f87ffc7, =2026.03.19.180705-f87ffc7, =2026.03.19.180705-f87ffc7,...

ai.looktech.ltrpc.schema:app-server-android (>=2.0.0, <=2.7.0), ai.looktech.ltrpc.schema:app-server-jvm (>=2.0.0, <=2.7.0) +115 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime-jvm (>=6.0.0-alpha01, <=6.2.0)

com.squareup.wire:wire-runtime-jvm MAVEN version =6.0.0-alpha01, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =1.5.0-alpha05, =1.5.0-alpha05, =1.5.0-alpha05, =1.5.0-alpha05, =1.5.0-alpha05, =2.0.0-alpha04, =2.0.0-alpha04, =2.0.0-alpha04, =2026.03.26.140500-911435f, =2026.03.26.140500-911435f,...

Wire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding service

CVE-2026-45799 Maintainer summary Wire's protobuf group-skipping logic did not reject negative lengths before skipping a length-delimited field inside a group. A crafted protobuf payload could cause Wire to throw an unchecked runtime exception during decoding instead of the documented IOException...

com.squareup.wire:wire-grpc-client (>=7.0.0-alpha01, <=7.0.0-alpha02), com.squareup.wire:wire-schema (>=7.0.0-alpha01, <=7.0.0-alpha02) +1 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime (>=7.0.0-alpha01, <=7.0.0-alpha02)

com.squareup.wire:wire-runtime MAVEN version =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha02 Source cves: CVE-2026-45799 Source advisory: GHSA-7XPR-HC2W-34M9...

com.squareup.wire:com.squareup.wire.gradle.plugin (>=7.0.0-alpha01, <=7.0.0-alpha02), com.squareup.wire:wire-compiler (>=7.0.0-alpha01, <=7.0.0-alpha02) +11 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime-jvm (>=7.0.0-alpha01, <=7.0.0-alpha02)

com.squareup.wire:wire-runtime-jvm MAVEN version =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha02 Source...