GHSA-86WM-R4C5-2RC9 Wire Swift runtime: negative LENGTH_DELIMITED length in skipGroup() crashes any protobuf-decoding service

Summary Wire's Swift runtime Wire SPM/CocoaPods product, implemented by wire-runtime-swift did not reject a negative LENGTHDELIMITED field length while skipping an unknown protobuf group. A crafted 10-byte protobuf payload could cause ProtoReader.skipGroup to read a length-delimited field whose...

Wire Swift runtime: negative LENGTH_DELIMITED length in skipGroup() crashes any protobuf-decoding service

Summary Wire's Swift runtime Wire SPM/CocoaPods product, implemented by wire-runtime-swift did not reject a negative LENGTHDELIMITED field length while skipping an unknown protobuf group. A crafted 10-byte protobuf payload could cause ProtoReader.skipGroup to read a length-delimited field whose...

Wire Swift runtime: negative LENGTH_DELIMITED length in skipGroup() crashes any protobuf-decoding service

Wire's Swift runtime Wire SPM/CocoaPods product, implemented by wire-runtime-swift did not reject a negative LENGTHDELIMITED field length while skipping an unknown protobuf group. A crafted 10-byte protobuf payload could cause ProtoReader.skipGroup to read a length-delimited field whose varint...

com.squareup.wire/wire-runtime: com.squareup.wire/wire-runtime-jvm: Wire: Remote Denial of Service due to improper protobuf length validation

A flaw was found in Wire, a library used for gRPC and protocol buffers. In the wire-runtime component, a remote attacker can exploit improper validation of a length-delimited field. By sending a crafted protobuf message with a negative length, the system attempts to access an invalid memory...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the ByteArrayProtoReader32 fast path in wire-runtime/src/commonMain/kotlin/com/squareup/wire/ByteArrayProtoReader32.kt. An attacker can crash protobuf decoding by supplying a length-delimited field wit...

ai.looktech.ltrpc.schema:app-server-tvosx64 (>=1.2.0, <=1.7.1), ai.looktech.ltrpc.schema:bt-server-tvosx64 (>=1.2.0, <=1.7.1) +3 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime-tvosx64 (>=4.5.3, <=6.4.1)

com.squareup.wire:wire-runtime-tvosx64 MAVEN version =4.5.3, =1.2.0, =1.2.0, =4.5.3, =4.9.0, =4.9.0, =6.4.1 Source cves: CVE-2026-63126 Source advisory: MEND:CVE-2026-63126...

ai.looktech.ltrpc.schema:app-server-linuxx64 (>=1.1.0, <=1.7.1), ai.looktech.ltrpc.schema:bt-server-linuxx64 (>=1.1.0, <=1.7.1) +16 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime-linuxx64 (>=3.2.0, <=6.4.1)

com.squareup.wire:wire-runtime-linuxx64 MAVEN version =3.2.0, =1.1.0, =1.1.0, =0.7, =0.7, =2.108.2, =3.2.0, =4.9.0, =4.9.0, =0.1.0, =2.85.0, =2.108.0 - io.github.ignaciodelatorrearias:ferrus-nexus-linuxx64 0.0.1 - io.github.ignaciodelatorrearias:greet-linuxx64 1.0.4 -...

ai.looktech.ltrpc.schema:app-server-tvosarm64 (>=1.2.0, <=1.7.1), ai.looktech.ltrpc.schema:bt-server-tvosarm64 (>=1.2.0, <=1.7.1) +5 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime-tvosarm64 (>=4.5.3, <=6.4.1)

com.squareup.wire:wire-runtime-tvosarm64 MAVEN version =4.5.3, =1.2.0, =1.2.0, =4.5.3, =4.9.0, =4.9.0, =0.7.0, =0.8.1 Source cves: CVE-2026-63126 Source advisory: MEND:CVE-2026-63126...

ai.looktech.ltrpc.schema:app-server-macosx64 (>=1.1.1, <=1.7.1), ai.looktech.ltrpc.schema:bt-server-macosx64 (>=1.1.1, <=1.7.1) +7 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime-macosx64 (>=3.2.0, <=6.4.1)

com.squareup.wire:wire-runtime-macosx64 MAVEN version =3.2.0, =1.1.1, =1.1.1, =0.7, =0.7, =3.2.0, =4.9.0, =4.9.0, =0.1, =0.1, =0.6 Source cves: CVE-2026-63126 Source advisory: MEND:CVE-2026-63126...

ai.looktech.ltrpc.schema:app-server-macosarm64 (>=1.1.1, <=1.7.1), ai.looktech.ltrpc.schema:bt-server-macosarm64 (>=1.1.1, <=1.7.1) +15 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime-macosarm64 (>=4.5.3, <=6.4.1)

com.squareup.wire:wire-runtime-macosarm64 MAVEN version =4.5.3, =1.1.1, =1.1.1, =0.7, =0.7, =0.1.1, =0.1.1, =4.5.3, =4.9.0, =4.9.0, =0.7.0, =0.8.1 and more Source cves: CVE-2026-63126 Source advisory: MEND:CVE-2026-63126...

ai.looktech.ltrpc.schema:app-server-iossimulatorarm64 (>=1.1.0, <=2.7.0), ai.looktech.ltrpc.schema:bt-server-iossimulatorarm64 (>=1.1.0, <=2.7.0) +38 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime-iossimulatorarm64 (>=4.5.3, <=6.4.1)

com.squareup.wire:wire-runtime-iossimulatorarm64 MAVEN version =4.5.3, =1.1.0, =1.1.0, =0.7, =0.7, =0.1.0, =1.5.0, =2.108.2, =4.5.3, =4.9.0, =4.9.0, =1.9.0, =2.1.0-rc1, =0.1.1, =0.1.11 and more Source cves: CVE-2026-63126 Source advisory: MEND:CVE-2026-63126htt...

ai.looktech.ltrpc.schema:app-server-tvossimulatorarm64 (>=1.2.0, <=1.7.1), ai.looktech.ltrpc.schema:bt-server-tvossimulatorarm64 (>=1.2.0, <=1.7.1) +5 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime-tvossimulatorarm64 (>=4.5.3, <=6.4.1)

com.squareup.wire:wire-runtime-tvossimulatorarm64 MAVEN version =4.5.3, =1.2.0, =1.2.0, =4.5.3, =4.9.0, =4.9.0, =0.7.0, =0.8.1 Source cves: CVE-2026-63126 Source advisory: MEND:CVE-2026-63126...

CVE-2026-45799

A flaw was found in Wire, a library used for gRPC and protocol buffers. In the wire-runtime component, a remote attacker can exploit improper validation of a length-delimited field. By sending a crafted protobuf message with a negative length, the system attempts to access an invalid memory...

ai.looktech.ltrpc.schema:app-server-android (>=1.1.0, <=2.7.0), ai.looktech.ltrpc.schema:app-server-jvm (>=1.0.2, <=2.7.0) +495 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime-jvm (>=3.0.0-alpha03, <=6.2.0)

com.squareup.wire:wire-runtime-jvm MAVEN version =3.0.0-alpha03, =1.1.0, =1.0.2, =1.1.0, =1.0.2, =0.0.1, =0.0.2, =0.1.1, =0.2.7, =0.2.7, =0.2.7, =0.1.1, =0.2.7, =0.2.11 and more Source cves: CVE-2026-45799 Source advisory: MEND:CVE-2026-45799...

CVE-2026-45799

Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.3.0 and 7.0.0-alpha03, ByteArrayProtoReader32.skipGroup and ProtoReader.skipGroup in wire-runtime do not validate that a LENGTHDELIMITED field length is non-negative before skip, allowing a crafted protobuf...

CVE-2026-45799

Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.3.0 and 7.0.0-alpha03, ByteArrayProtoReader32.skipGroup and ProtoReader.skipGroup in wire-runtime do not validate that a LENGTHDELIMITED field length is non-negative before skip, allowing a crafted protobuf...

CVE-2026-45799: Improper Validation of Array Index

Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.3.0 and 7.0.0-alpha03, ByteArrayProtoReader32.skipGroup and ProtoReader.skipGroup in wire-runtime do not validate that a LENGTHDELIMITED field length is non-negative before skip, allowing a crafted protobuf...

Improper Validation of Array Index

Overview Affected versions of this package are vulnerable to Improper Validation of Array Index in the skipGroup function. An attacker can cause a service crash by sending a crafted protobuf payload with a negative length in a length-delimited field inside a group, leading to an unchecked runtime...

Wire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding service

CVE-2026-45799 Maintainer summary Wire's protobuf group-skipping logic did not reject negative lengths before skipping a length-delimited field inside a group. A crafted protobuf payload could cause Wire to throw an unchecked runtime exception during decoding instead of the documented IOException...

GHSA-7XPR-HC2W-34M9 Wire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding service

CVE-2026-45799 Maintainer summary Wire's protobuf group-skipping logic did not reject negative lengths before skipping a length-delimited field inside a group. A crafted protobuf payload could cause Wire to throw an unchecked runtime exception during decoding instead of the documented IOException...