com.squareup.wire:wire-grpc-client (4.0.0-alpha.8), com.squareup.wire:wire-schema (4.0.0-alpha.8) potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime (4.0.0-alpha.8)

com.squareup.wire:wire-runtime MAVEN version 4.0.0-alpha.8 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.0.0-alpha.8 - com.squareup.wire:wire-schema...

com.squareup.misk:misk (>=2025.08.07.142709-b2b6e6c, <=2025.08.08.100635-5aa9c39), com.squareup.misk:misk-admin (>=2025.08.07.142709-b2b6e6c, <=2025.08.08.100635-5aa9c39) +27 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime (5.3.7)

com.squareup.wire:wire-runtime MAVEN version 5.3.7 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.misk:misk =2025.08.07.142709-b2b6e6c, =2025.08.07.142709-b2b6e6c,...

app.cash.chronicler:chronicler-player (1.0.1), app.cash.chronicler:chronicler-proto (1.0.1) +16 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime-jvm (4.0.0-alpha.19)

com.squareup.wire:wire-runtime-jvm MAVEN version 4.0.0-alpha.19 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime-jvm and may be impacted: - app.cash.chronicler:chronicler-player 1.0.1 - app.cash.chronicler:chronicler-proto...

com.slack.gradle:sgp-tracing (>=0.10.9, <=0.13.0), com.squareup.wire:com.squareup.wire.gradle.plugin (4.9.1) +19 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime-jvm (4.9.1)

com.squareup.wire:wire-runtime-jvm MAVEN version 4.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime-jvm and may be impacted: - com.slack.gradle:sgp-tracing =0.10.9, =0.13.0 -...

com.squareup.wire:wire-grpc-client (4.9.2), com.squareup.wire:wire-schema (4.9.2) +4 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime (4.9.2)

com.squareup.wire:wire-runtime MAVEN version 4.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.9.2 - com.squareup.wire:wire-schema 4.9.2 -...

com.squareup.wire:com.squareup.wire.gradle.plugin (4.0.0-alpha.15), com.squareup.wire:wire-compiler (4.0.0-alpha.15) +12 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime-jvm (4.0.0-alpha.15)

com.squareup.wire:wire-runtime-jvm MAVEN version 4.0.0-alpha.15 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime-jvm and may be impacted: - com.squareup.wire:com.squareup.wire.gradle.plugin 4.0.0-alpha.15 -...

com.squareup.wire:com.squareup.wire.gradle.plugin (4.6.0), com.squareup.wire:wire-compiler (4.6.0) +12 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime-jvm (4.6.0)

com.squareup.wire:wire-runtime-jvm MAVEN version 4.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime-jvm and may be impacted: - com.squareup.wire:com.squareup.wire.gradle.plugin 4.6.0 - com.squareup.wire:wire-compiler...

com.squareup.wire:com.squareup.wire.gradle.plugin (4.0.0), com.squareup.wire:wire-compiler (4.0.0) +12 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime-jvm (4.0.0)

com.squareup.wire:wire-runtime-jvm MAVEN version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime-jvm and may be impacted: - com.squareup.wire:com.squareup.wire.gradle.plugin 4.0.0 - com.squareup.wire:wire-compiler...

com.squareup.wire:wire-grpc-client (4.2.0), com.squareup.wire:wire-schema (4.2.0) potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime (4.2.0)

com.squareup.wire:wire-runtime MAVEN version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.2.0 - com.squareup.wire:wire-schema 4.2.0 Source cves:...

com.eygraber.gradle.dependency-attribution-android:com.eygraber.gradle.dependency-attribution-android.gradle.plugin (>=0.0.1, <=0.0.5), com.eygraber.gradle.dependency-attribution-jvm:com.eygraber.gradle.dependency-attribution-jvm.gradle.plugin (>=0.0.1, <=0.0.5) +20 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime-jvm (4.7.2)

com.squareup.wire:wire-runtime-jvm MAVEN version 4.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime-jvm and may be impacted: -...

GHSA-7XPR-HC2W-34M9 Wire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding service

CVE-2026-45799 Maintainer summary Wire's protobuf group-skipping logic did not reject negative lengths before skipping a length-delimited field inside a group. A crafted protobuf payload could cause Wire to throw an unchecked runtime exception during decoding instead of the documented IOException...

Improper Validation of Array Index

Overview Affected versions of this package are vulnerable to Improper Validation of Array Index in the skipGroup function. An attacker can cause a service crash by sending a crafted protobuf payload with a negative length in a length-delimited field inside a group, leading to an unchecked runtime...

com.squareup.misk:misk (>=2025.08.19.093556-9a9e98f, <=2025.09.02.160854-b53b5bd), com.squareup.misk:misk-admin (>=2025.08.19.093556-9a9e98f, <=2025.09.02.160854-b53b5bd) +31 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime (5.3.11)

com.squareup.wire:wire-runtime MAVEN version 5.3.11 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.misk:misk =2025.08.19.093556-9a9e98f, =2025.08.19.093556-9a9e98f,...

com.squareup.misk:misk (0.6.0), com.squareup.misk:misk-aws (0.6.0) +33 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime (3.0.0-alpha01)

com.squareup.wire:wire-runtime MAVEN version 3.0.0-alpha01 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.misk:misk 0.6.0 - com.squareup.misk:misk-aws 0.6.0 -...

com.codellyrandom.wiretypescriptgenerator:wire-typescript-generator (0.2.0), com.squareup.wire:com.squareup.wire.gradle.plugin (4.0.1) +13 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime-jvm (4.0.1)

com.squareup.wire:wire-runtime-jvm MAVEN version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime-jvm and may be impacted: - com.codellyrandom.wiretypescriptgenerator:wire-typescript-generator 0.2.0 -...

com.cloudflare.realtimekit:core (>=0.1.0, <=1.1.0), com.cloudflare.realtimekit:mobile-core-bridge (>=1.5.0, <=1.5.6) +6 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime (4.7.2)

com.squareup.wire:wire-runtime MAVEN version 4.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.cloudflare.realtimekit:core =0.1.0, =1.5.0, =0.0.1, =1.19.16, =1.0.1, =1.2.1, =1.4.1 Source cve...

Improper Validation of Array Index

Overview Affected versions of this package are vulnerable to Improper Validation of Array Index in the skipGroup function. An attacker can cause a service crash by sending a crafted protobuf payload with a negative length in a length-delimited field inside a group, leading to an unchecked runtime...

com.github.cloudfoundry-community:snotel (>=0.3.m1, <=0.3.m3), com.github.cloudfoundry-community:snotel-spring-boot-config (>=0.3.m1, <=0.3.m3) +6 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime (1.8.0)

com.squareup.wire:wire-runtime MAVEN version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.github.cloudfoundry-community:snotel =0.3.m1, =0.3.m1, =0.3.m1, =0.6.0beta, =0.0.3, =0.0.4 Sour...

com.github.turasa:models-jvm (>=2.15.3_unofficial_136, <=2.15.3_unofficial_145), com.github.turasa:signal-network (2.15.3_unofficial_145) +22 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime-jvm (4.9.11)

com.squareup.wire:wire-runtime-jvm MAVEN version 4.9.11 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime-jvm and may be impacted: - com.github.turasa:models-jvm =2.15.3unofficial136, =2.15.3unofficial136,...

com.squareup.wire:com.squareup.wire.gradle.plugin (4.0.0-alpha.17), com.squareup.wire:wire-compiler (4.0.0-alpha.17) +12 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime-jvm (4.0.0-alpha.17)

com.squareup.wire:wire-runtime-jvm MAVEN version 4.0.0-alpha.17 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime-jvm and may be impacted: - com.squareup.wire:com.squareup.wire.gradle.plugin 4.0.0-alpha.17 -...