com.squareup.retrofit2:converter-wire (2.0.0-beta3), com.squareup.wire:wire-compiler (2.0.0) +6 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (2.0.0)

com.squareup.wire:wire-runtime MAVEN version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.retrofit2:converter-wire 2.0.0-beta3 - com.squareup.wire:wire-compiler 2.0.0 -...

com.gitee.chinasoft_ohos:svgaplayer-ohos (>=1.0.0, <=1.0.1), com.immomo.cosmos.effect:mmsvga (>=0.2.2021.0125.1, <=0.2.2021.0823.1_tantan) +27 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (2.3.0-rc1)

com.squareup.wire:wire-runtime MAVEN version 2.3.0-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.gitee.chinasoftohos:svgaplayer-ohos =1.0.0, =0.2.2021.0125.1, =1.0.0, =0.0.1, =0.2.2, =0.1....

at.released.igdbclient:igdbclient-core (0.8), at.released.igdbclient:igdbclient-ktor (0.8) +5 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (5.3.0)

com.squareup.wire:wire-runtime MAVEN version 5.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - at.released.igdbclient:igdbclient-core 0.8 - at.released.igdbclient:igdbclient-ktor 0.8 -...

com.squareup.misk:misk (0.8.0), com.squareup.misk:misk-aws (0.8.0) +34 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (3.0.0)

com.squareup.wire:wire-runtime MAVEN version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.misk:misk 0.8.0 - com.squareup.misk:misk-aws 0.8.0 - com.squareup.misk:misk-crypto 0.8...

com.eulerstream:tiktok-live-proto (0.1.1), com.eulerstream:tiktok-live-proto-kotlin (0.1.1) +6 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (5.5.1)

com.squareup.wire:wire-runtime MAVEN version 5.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.eulerstream:tiktok-live-proto 0.1.1 - com.eulerstream:tiktok-live-proto-kotlin 0.1.1 -...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the ByteArrayProtoReader32 fast path in wire-runtime/src/commonMain/kotlin/com/squareup/wire/ByteArrayProtoReader32.kt. An attacker can crash protobuf decoding by supplying a length-delimited field wit...

com.squareup.misk:misk (2025.08.14.063635-1fd415a), com.squareup.misk:misk-admin (2025.08.14.063635-1fd415a) +27 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (5.3.9)

com.squareup.wire:wire-runtime MAVEN version 5.3.9 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.misk:misk 2025.08.14.063635-1fd415a - com.squareup.misk:misk-admin...

com.squareup.wire:wire-grpc-client (4.0.0-alpha.17), com.squareup.wire:wire-schema (4.0.0-alpha.17) potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (4.0.0-alpha.17)

com.squareup.wire:wire-runtime MAVEN version 4.0.0-alpha.17 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.0.0-alpha.17 - com.squareup.wire:wire-schema...

ai.looktech.ltrpc.schema:app-server-macosx64 (>=1.1.1, <=1.7.1), ai.looktech.ltrpc.schema:bt-server-macosx64 (>=1.1.1, <=1.7.1) +7 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime-macosx64 (>=3.2.0, <=6.4.1)

com.squareup.wire:wire-runtime-macosx64 MAVEN version =3.2.0, =1.1.1, =1.1.1, =0.7, =0.7, =3.2.0, =4.9.0, =4.9.0, =0.1, =0.1, =0.6 Source cves: CVE-2026-63126 Source advisory: MEND:CVE-2026-63126...

ai.looktech.ltrpc.schema:app-server-tvossimulatorarm64 (>=1.2.0, <=1.7.1), ai.looktech.ltrpc.schema:bt-server-tvossimulatorarm64 (>=1.2.0, <=1.7.1) +5 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime-tvossimulatorarm64 (>=4.5.3, <=6.4.1)

com.squareup.wire:wire-runtime-tvossimulatorarm64 MAVEN version =4.5.3, =1.2.0, =1.2.0, =4.5.3, =4.9.0, =4.9.0, =0.7.0, =0.8.1 Source cves: CVE-2026-63126 Source advisory: MEND:CVE-2026-63126...

ai.looktech.ltrpc.schema:app-server-tvosarm64 (>=1.2.0, <=1.7.1), ai.looktech.ltrpc.schema:bt-server-tvosarm64 (>=1.2.0, <=1.7.1) +5 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime-tvosarm64 (>=4.5.3, <=6.4.1)

com.squareup.wire:wire-runtime-tvosarm64 MAVEN version =4.5.3, =1.2.0, =1.2.0, =4.5.3, =4.9.0, =4.9.0, =0.7.0, =0.8.1 Source cves: CVE-2026-63126 Source advisory: MEND:CVE-2026-63126...

ai.looktech.ltrpc.schema:app-server-iossimulatorarm64 (>=1.1.0, <=2.7.0), ai.looktech.ltrpc.schema:bt-server-iossimulatorarm64 (>=1.1.0, <=2.7.0) +38 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime-iossimulatorarm64 (>=4.5.3, <=6.4.1)

com.squareup.wire:wire-runtime-iossimulatorarm64 MAVEN version =4.5.3, =1.1.0, =1.1.0, =0.7, =0.7, =0.1.0, =1.5.0, =2.108.2, =4.5.3, =4.9.0, =4.9.0, =1.9.0, =2.1.0-rc1, =0.1.1, =0.1.9 and more Source cves: CVE-2026-63126 Source advisory: MEND:CVE-2026-63126http...

ai.looktech.ltrpc.schema:app-server-tvosx64 (>=1.2.0, <=1.7.1), ai.looktech.ltrpc.schema:bt-server-tvosx64 (>=1.2.0, <=1.7.1) +3 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime-tvosx64 (>=4.5.3, <=6.4.1)

com.squareup.wire:wire-runtime-tvosx64 MAVEN version =4.5.3, =1.2.0, =1.2.0, =4.5.3, =4.9.0, =4.9.0, =6.4.1 Source cves: CVE-2026-63126 Source advisory: MEND:CVE-2026-63126...

ai.looktech.ltrpc.schema:app-server-linuxx64 (>=1.1.0, <=1.7.1), ai.looktech.ltrpc.schema:bt-server-linuxx64 (>=1.1.0, <=1.7.1) +16 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime-linuxx64 (>=3.2.0, <=6.4.1)

com.squareup.wire:wire-runtime-linuxx64 MAVEN version =3.2.0, =1.1.0, =1.1.0, =0.7, =0.7, =2.108.2, =3.2.0, =4.9.0, =4.9.0, =0.1.0, =2.85.0, =2.108.0 - io.github.ignaciodelatorrearias:ferrus-nexus-linuxx64 0.0.1 - io.github.ignaciodelatorrearias:greet-linuxx64 1.0.4 -...

ai.looktech.ltrpc.schema:app-server-macosarm64 (>=1.1.1, <=1.7.1), ai.looktech.ltrpc.schema:bt-server-macosarm64 (>=1.1.1, <=1.7.1) +13 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime-macosarm64 (>=4.5.3, <=6.4.1)

com.squareup.wire:wire-runtime-macosarm64 MAVEN version =4.5.3, =1.1.1, =1.1.1, =0.7, =0.7, =0.1.1, =0.1.1, =4.5.3, =4.9.0, =4.9.0, =0.7.0, =0.1, =0.1, =0.6 Source cves: CVE-2026-63126 Source advisory: MEND:CVE-2026-63126...

CVE-2026-45799

A flaw was found in Wire, a library used for gRPC and protocol buffers. In the wire-runtime component, a remote attacker can exploit improper validation of a length-delimited field. By sending a crafted protobuf message with a negative length, the system attempts to access an invalid memory...

ai.looktech.ltrpc.schema:app-server-android (>=1.1.0, <=2.7.0), ai.looktech.ltrpc.schema:app-server-jvm (>=1.0.2, <=2.7.0) +491 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime-jvm (>=3.0.0-alpha03, <=6.2.0)

com.squareup.wire:wire-runtime-jvm MAVEN version =3.0.0-alpha03, =1.1.0, =1.0.2, =1.1.0, =1.0.2, =0.0.1, =0.0.2, =0.1.1, =0.2.7, =0.2.7, =0.2.7, =0.1.1, =0.2.7, =0.2.11 and more Source cves: CVE-2026-45799 Source advisory: MEND:CVE-2026-45799...

CVE-2026-45799

Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.3.0 and 7.0.0-alpha03, ByteArrayProtoReader32.skipGroup and ProtoReader.skipGroup in wire-runtime do not validate that a LENGTHDELIMITED field length is non-negative before skip, allowing a crafted protobuf...

CVE-2026-45799

Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.3.0 and 7.0.0-alpha03, ByteArrayProtoReader32.skipGroup and ProtoReader.skipGroup in wire-runtime do not validate that a LENGTHDELIMITED field length is non-negative before skip, allowing a crafted protobuf...

CVE-2026-45799: Improper Validation of Array Index

Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.3.0 and 7.0.0-alpha03, ByteArrayProtoReader32.skipGroup and ProtoReader.skipGroup in wire-runtime do not validate that a LENGTHDELIMITED field length is non-negative before skip, allowing a crafted protobuf...