GHSA-86WM-R4C5-2RC9 Wire Swift runtime: negative LENGTH_DELIMITED length in skipGroup() crashes any protobuf-decoding service

Summary Wire's Swift runtime Wire SPM/CocoaPods product, implemented by wire-runtime-swift did not reject a negative LENGTHDELIMITED field length while skipping an unknown protobuf group. A crafted 10-byte protobuf payload could cause ProtoReader.skipGroup to read a length-delimited field whose...

Wire Swift runtime: negative LENGTH_DELIMITED length in skipGroup() crashes any protobuf-decoding service

Summary Wire's Swift runtime Wire SPM/CocoaPods product, implemented by wire-runtime-swift did not reject a negative LENGTHDELIMITED field length while skipping an unknown protobuf group. A crafted 10-byte protobuf payload could cause ProtoReader.skipGroup to read a length-delimited field whose...

Wire Swift runtime: negative LENGTH_DELIMITED length in skipGroup() crashes any protobuf-decoding service

Wire's Swift runtime Wire SPM/CocoaPods product, implemented by wire-runtime-swift did not reject a negative LENGTHDELIMITED field length while skipping an unknown protobuf group. A crafted 10-byte protobuf payload could cause ProtoReader.skipGroup to read a length-delimited field whose varint...

com.squareup.wire/wire-runtime: com.squareup.wire/wire-runtime-jvm: Wire: Remote Denial of Service due to improper protobuf length validation

A flaw was found in Wire, a library used for gRPC and protocol buffers. In the wire-runtime component, a remote attacker can exploit improper validation of a length-delimited field. By sending a crafted protobuf message with a negative length, the system attempts to access an invalid memory...

com.squareup.wire:wire-grpc-client (4.0.0-alpha.8), com.squareup.wire:wire-schema (4.0.0-alpha.8) potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (4.0.0-alpha.8)

com.squareup.wire:wire-runtime MAVEN version 4.0.0-alpha.8 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.0.0-alpha.8 - com.squareup.wire:wire-schema...

com.squareup.misk:misk (0.20.0), com.squareup.misk:misk-admin (0.20.0) +45 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (4.0.0-alpha.7)

com.squareup.wire:wire-runtime MAVEN version 4.0.0-alpha.7 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.misk:misk 0.20.0 - com.squareup.misk:misk-admin 0.20.0 -...

com.squareup.wire:wire-compiler (1.3.1), com.squareup.wire:wire-gson-support (1.3.1) +1 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (1.3.1)

com.squareup.wire:wire-runtime MAVEN version 1.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-compiler 1.3.1 - com.squareup.wire:wire-gson-support 1.3.1 -...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the ByteArrayProtoReader32 fast path in wire-runtime/src/commonMain/kotlin/com/squareup/wire/ByteArrayProtoReader32.kt. An attacker can crash protobuf decoding by supplying a length-delimited field wit...

com.squareup.misk:misk (>=2025.06.03.182934-790a8b3, <=2025.06.05.100657-d32f88d), com.squareup.misk:misk-admin (>=2025.06.03.182934-790a8b3, <=2025.06.05.100657-d32f88d) +19 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (5.3.2)

com.squareup.wire:wire-runtime MAVEN version 5.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.misk:misk =2025.06.03.182934-790a8b3, =2025.06.03.182934-790a8b3,...

com.squareup.retrofit2:converter-wire (>=2.0.0, <=2.0.2), com.squareup.wire:wire-codegen-sample (2.1.1) +8 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (2.1.1)

com.squareup.wire:wire-runtime MAVEN version 2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.retrofit2:converter-wire =2.0.0, =2.0.01, =2.0.21 Source cves: CVE-2026-63126 Source...

androidx.benchmark:benchmark-common (>=1.2.0-alpha02, <=1.2.0-alpha13), androidx.benchmark:benchmark-junit4 (>=1.2.0-alpha02, <=1.2.0-alpha13) +5 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (4.4.1)

com.squareup.wire:wire-runtime MAVEN version 4.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - androidx.benchmark:benchmark-common =1.2.0-alpha02, =1.2.0-alpha02, =1.2.0-alpha02, =1.2.0-alpha02,...

com.squareup.wire:wire-grpc-client (4.9.1), com.squareup.wire:wire-schema (4.9.1) +8 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (4.9.1)

com.squareup.wire:wire-runtime MAVEN version 4.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.9.1 - com.squareup.wire:wire-schema 4.9.1 -...

com.squareup.wire:wire-grpc-client (4.6.1), com.squareup.wire:wire-schema (4.6.1) potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (4.6.1)

com.squareup.wire:wire-runtime MAVEN version 4.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.6.1 - com.squareup.wire:wire-schema 4.6.1 Source cves:...

com.jiechic.library.wire:wire-gradle-plugin (>=1.0.0, <=1.0.1), com.squareup.wire:wire-codegen-sample (2.1.2) +9 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (2.1.2)

com.squareup.wire:wire-runtime MAVEN version 2.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.jiechic.library.wire:wire-gradle-plugin =1.0.0, =0.6.6, =2.0.0.m5, =2.0.0.m5, =2.0.0.m7 Source...

com.squareup.wire:wire-compiler (2.0.1), com.squareup.wire:wire-gson-support (2.0.1) +4 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (2.0.1)

com.squareup.wire:wire-runtime MAVEN version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-compiler 2.0.1 - com.squareup.wire:wire-gson-support 2.0.1 -...

com.squareup.retrofit2:converter-wire (2.0.0-beta4), com.squareup.wire:wire-codegen-sample (2.1.0) +6 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (2.1.0)

com.squareup.wire:wire-runtime MAVEN version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.retrofit2:converter-wire 2.0.0-beta4 - com.squareup.wire:wire-codegen-sample 2.1.0 -...

com.squareup.wire:wire-compiler (1.1.1), com.squareup.wire:wire-gson-support (1.1.1) potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (1.1.1)

com.squareup.wire:wire-runtime MAVEN version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-compiler 1.1.1 - com.squareup.wire:wire-gson-support 1.1.1 Source cves:...

com.squareup.wire:wire-grpc-client (5.0.0-alpha01), com.squareup.wire:wire-schema (5.0.0-alpha01) +1 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (5.0.0-alpha01)

com.squareup.wire:wire-runtime MAVEN version 5.0.0-alpha01 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 5.0.0-alpha01 - com.squareup.wire:wire-schema...

com.squareup.wire:wire-grpc-client (4.4.0), com.squareup.wire:wire-schema (4.4.0) potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (4.4.0)

com.squareup.wire:wire-runtime MAVEN version 4.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.4.0 - com.squareup.wire:wire-schema 4.4.0 Source cves:...

com.github.cloudfoundry-community:snotel (>=0.3.m1, <=0.3.m3), com.github.cloudfoundry-community:snotel-spring-boot-config (>=0.3.m1, <=0.3.m3) +6 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (1.8.0)

com.squareup.wire:wire-runtime MAVEN version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.github.cloudfoundry-community:snotel =0.3.m1, =0.3.m1, =0.3.m1, =0.6.0beta, =0.0.3, =0.0.4 Sour...