GHSA-86WM-R4C5-2RC9 Wire Swift runtime: negative LENGTH_DELIMITED length in skipGroup() crashes any protobuf-decoding service

Summary Wire's Swift runtime Wire SPM/CocoaPods product, implemented by wire-runtime-swift did not reject a negative LENGTHDELIMITED field length while skipping an unknown protobuf group. A crafted 10-byte protobuf payload could cause ProtoReader.skipGroup to read a length-delimited field whose...

Wire Swift runtime: negative LENGTH_DELIMITED length in skipGroup() crashes any protobuf-decoding service

Summary Wire's Swift runtime Wire SPM/CocoaPods product, implemented by wire-runtime-swift did not reject a negative LENGTHDELIMITED field length while skipping an unknown protobuf group. A crafted 10-byte protobuf payload could cause ProtoReader.skipGroup to read a length-delimited field whose...

Wire Swift runtime: negative LENGTH_DELIMITED length in skipGroup() crashes any protobuf-decoding service

Wire's Swift runtime Wire SPM/CocoaPods product, implemented by wire-runtime-swift did not reject a negative LENGTHDELIMITED field length while skipping an unknown protobuf group. A crafted 10-byte protobuf payload could cause ProtoReader.skipGroup to read a length-delimited field whose varint...

com.squareup.wire/wire-runtime: com.squareup.wire/wire-runtime-jvm: Wire: Remote Denial of Service due to improper protobuf length validation

A flaw was found in Wire, a library used for gRPC and protocol buffers. In the wire-runtime component, a remote attacker can exploit improper validation of a length-delimited field. By sending a crafted protobuf message with a negative length, the system attempts to access an invalid memory...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the ByteArrayProtoReader32 fast path in wire-runtime/src/commonMain/kotlin/com/squareup/wire/ByteArrayProtoReader32.kt. An attacker can crash protobuf decoding by supplying a length-delimited field wit...

com.squareup.wire:wire-grpc-client (4.0.0-alpha.8), com.squareup.wire:wire-schema (4.0.0-alpha.8) potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (4.0.0-alpha.8)

com.squareup.wire:wire-runtime MAVEN version 4.0.0-alpha.8 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.0.0-alpha.8 - com.squareup.wire:wire-schema...

com.squareup.misk:misk (0.20.0), com.squareup.misk:misk-admin (0.20.0) +45 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (4.0.0-alpha.7)

com.squareup.wire:wire-runtime MAVEN version 4.0.0-alpha.7 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.misk:misk 0.20.0 - com.squareup.misk:misk-admin 0.20.0 -...

com.squareup.misk:misk (>=2025.06.03.182934-790a8b3, <=2025.06.05.100657-d32f88d), com.squareup.misk:misk-admin (>=2025.06.03.182934-790a8b3, <=2025.06.05.100657-d32f88d) +19 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (5.3.2)

com.squareup.wire:wire-runtime MAVEN version 5.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.misk:misk =2025.06.03.182934-790a8b3, =2025.06.03.182934-790a8b3,...

com.squareup.wire:wire-compiler (1.3.1), com.squareup.wire:wire-gson-support (1.3.1) +1 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (1.3.1)

com.squareup.wire:wire-runtime MAVEN version 1.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-compiler 1.3.1 - com.squareup.wire:wire-gson-support 1.3.1 -...

com.squareup.retrofit2:converter-wire (>=2.0.0, <=2.0.2), com.squareup.wire:wire-codegen-sample (2.1.1) +8 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (2.1.1)

com.squareup.wire:wire-runtime MAVEN version 2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.retrofit2:converter-wire =2.0.0, =2.0.01, =2.0.21 Source cves: CVE-2026-63126 Source...

androidx.benchmark:benchmark-common (>=1.2.0-alpha02, <=1.2.0-alpha13), androidx.benchmark:benchmark-junit4 (>=1.2.0-alpha02, <=1.2.0-alpha13) +5 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (4.4.1)

com.squareup.wire:wire-runtime MAVEN version 4.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - androidx.benchmark:benchmark-common =1.2.0-alpha02, =1.2.0-alpha02, =1.2.0-alpha02, =1.2.0-alpha02,...

com.squareup.wire:wire-grpc-client (4.9.1), com.squareup.wire:wire-schema (4.9.1) +8 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (4.9.1)

com.squareup.wire:wire-runtime MAVEN version 4.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.9.1 - com.squareup.wire:wire-schema 4.9.1 -...

com.squareup.wire:wire-compiler (2.0.0-beta5), com.squareup.wire:wire-gson-support (2.0.0-beta5) +3 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (2.0.0-beta5)

com.squareup.wire:wire-runtime MAVEN version 2.0.0-beta5 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-compiler 2.0.0-beta5 - com.squareup.wire:wire-gson-support 2.0.0-beta5...

com.squareup.wire:wire-grpc-client (4.6.1), com.squareup.wire:wire-schema (4.6.1) potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (4.6.1)

com.squareup.wire:wire-runtime MAVEN version 4.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.6.1 - com.squareup.wire:wire-schema 4.6.1 Source cves:...

com.jiechic.library.wire:wire-gradle-plugin (>=1.0.0, <=1.0.1), com.squareup.wire:wire-codegen-sample (2.1.2) +9 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (2.1.2)

com.squareup.wire:wire-runtime MAVEN version 2.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.jiechic.library.wire:wire-gradle-plugin =1.0.0, =0.6.6, =2.0.0.m5, =2.0.0.m5, =2.0.0.m7 Source...

com.eulerstream:tiktok-live-proto (0.1.1), com.eulerstream:tiktok-live-proto-kotlin (0.1.1) +6 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (5.5.1)

com.squareup.wire:wire-runtime MAVEN version 5.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.eulerstream:tiktok-live-proto 0.1.1 - com.eulerstream:tiktok-live-proto-kotlin 0.1.1 -...

com.squareup.retrofit:converter-wire (1.6.1), com.squareup.wire:wire-compiler (1.5.1) +2 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (1.5.1)

com.squareup.wire:wire-runtime MAVEN version 1.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.retrofit:converter-wire 1.6.1 - com.squareup.wire:wire-compiler 1.5.1 -...

com.squareup.wire:wire-compiler (2.0.1), com.squareup.wire:wire-gson-support (2.0.1) +4 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (2.0.1)

com.squareup.wire:wire-runtime MAVEN version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-compiler 2.0.1 - com.squareup.wire:wire-gson-support 2.0.1 -...

at.released.igdbclient:igdbclient-core (0.8), at.released.igdbclient:igdbclient-ktor (0.8) +5 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (5.3.0)

com.squareup.wire:wire-runtime MAVEN version 5.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - at.released.igdbclient:igdbclient-core 0.8 - at.released.igdbclient:igdbclient-ktor 0.8 -...

com.squareup.wire:wire-grpc-client (4.4.0), com.squareup.wire:wire-schema (4.4.0) potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (4.4.0)

com.squareup.wire:wire-runtime MAVEN version 4.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.4.0 - com.squareup.wire:wire-schema 4.4.0 Source cves:...