app.cash.backfila:service (>=2024.05.14.022814-c3cba42, <=2024.08.23.143736-34a2a42), app.cash.backfila:service-self-backfill (>=2024.05.14.022814-c3cba42, <=2024.08.23.143736-34a2a42) +147 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime-jvm (4.9.3)

com.squareup.wire:wire-runtime-jvm MAVEN version 4.9.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime-jvm and may be impacted: - app.cash.backfila:service =2024.05.14.022814-c3cba42, =2024.05.14.022814-c3cba42, =1.0.0,...

com.squareup.wire:com.squareup.wire.gradle.plugin (4.5.2), com.squareup.wire:wire-compiler (4.5.2) +12 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime-jvm (4.5.2)

com.squareup.wire:wire-runtime-jvm MAVEN version 4.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime-jvm and may be impacted: - com.squareup.wire:com.squareup.wire.gradle.plugin 4.5.2 - com.squareup.wire:wire-compiler...

com.squareup.wire:wire-grpc-client (4.0.0-alpha.16), com.squareup.wire:wire-schema (4.0.0-alpha.16) potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime (4.0.0-alpha.16)

com.squareup.wire:wire-runtime MAVEN version 4.0.0-alpha.16 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.0.0-alpha.16 - com.squareup.wire:wire-schema...

app.cash.backfila:service (>=2025.04.04.113522-414f675, <=2025.07.24.041611-fe2805d), app.cash.backfila:service-self-backfill (>=2025.04.04.113522-414f675, <=2025.07.24.041611-fe2805d) +63 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime-jvm (5.3.1)

com.squareup.wire:wire-runtime-jvm MAVEN version 5.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime-jvm and may be impacted: - app.cash.backfila:service =2025.04.04.113522-414f675, =2025.04.04.113522-414f675, =0.1.1,...

build.buf:connect-library (0.0.0-test), build.buf:connect-library-pt (>=0.0.0-test1, <=0.0.0-test2) +18 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime-jvm (4.4.1)

com.squareup.wire:wire-runtime-jvm MAVEN version 4.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime-jvm and may be impacted: - build.buf:connect-library 0.0.0-test - build.buf:connect-library-pt =0.0.0-test1, =0.3.0,...

com.squareup.wire:wire-grpc-client (4.0.0-alpha.15), com.squareup.wire:wire-schema (4.0.0-alpha.15) potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime (4.0.0-alpha.15)

com.squareup.wire:wire-runtime MAVEN version 4.0.0-alpha.15 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.0.0-alpha.15 - com.squareup.wire:wire-schema...

com.squareup.wire:com.squareup.wire.gradle.plugin (4.0.0-alpha.20), com.squareup.wire:wire-compiler (4.0.0-alpha.20) +12 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime-jvm (4.0.0-alpha.20)

com.squareup.wire:wire-runtime-jvm MAVEN version 4.0.0-alpha.20 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime-jvm and may be impacted: - com.squareup.wire:com.squareup.wire.gradle.plugin 4.0.0-alpha.20 -...

com.squareup.misk:misk (>=2025.08.07.142709-b2b6e6c, <=2025.08.08.100635-5aa9c39), com.squareup.misk:misk-admin (>=2025.08.07.142709-b2b6e6c, <=2025.08.08.100635-5aa9c39) +27 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime (5.3.7)

com.squareup.wire:wire-runtime MAVEN version 5.3.7 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.misk:misk =2025.08.07.142709-b2b6e6c, =2025.08.07.142709-b2b6e6c,...

com.squareup.misk.schema-migrator:com.squareup.misk.schema-migrator.gradle.plugin (2025.08.14.063635-1fd415a), com.squareup.misk.vitess.vitess-database:com.squareup.misk.vitess.vitess-database.gradle.plugin (2025.08.14.063635-1fd415a) +56 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime-jvm (5.3.9)

com.squareup.wire:wire-runtime-jvm MAVEN version 5.3.9 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime-jvm and may be impacted: - com.squareup.misk.schema-migrator:com.squareup.misk.schema-migrator.gradle.plugin...

androidx.benchmark:benchmark-common (>=1.4.0-alpha08, <=1.4.1), androidx.benchmark:benchmark-macro (>=1.4.0-alpha08, <=1.4.1) +39 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime (5.2.1)

com.squareup.wire:wire-runtime MAVEN version 5.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - androidx.benchmark:benchmark-common =1.4.0-alpha08, =1.4.0-alpha08, =1.4.0-alpha08,...

com.aliyun.rum:alibabacloud-android-rum-sdk (>=0.4.0-beta.1, <=2.0.3), com.squareup.misk:misk (>=2025.03.05.153222-bda057a, <=2025.06.03.161336-a14ce45) +26 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime (5.3.1)

com.squareup.wire:wire-runtime MAVEN version 5.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.aliyun.rum:alibabacloud-android-rum-sdk =0.4.0-beta.1, =2025.03.05.153222-bda057a,...

com.squareup.wire:com.squareup.wire.gradle.plugin (4.0.0-alpha.16), com.squareup.wire:wire-compiler (4.0.0-alpha.16) +12 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime-jvm (4.0.0-alpha.16)

com.squareup.wire:wire-runtime-jvm MAVEN version 4.0.0-alpha.16 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime-jvm and may be impacted: - com.squareup.wire:com.squareup.wire.gradle.plugin 4.0.0-alpha.16 -...

com.squareup.misk:misk (2025.08.14.063635-1fd415a), com.squareup.misk:misk-admin (2025.08.14.063635-1fd415a) +27 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime (5.3.9)

com.squareup.wire:wire-runtime MAVEN version 5.3.9 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.misk:misk 2025.08.14.063635-1fd415a - com.squareup.misk:misk-admin...

com.squareup.wire:com.squareup.wire.gradle.plugin (>=7.0.0-alpha01, <=7.0.0-alpha02), com.squareup.wire:wire-compiler (>=7.0.0-alpha01, <=7.0.0-alpha02) +11 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime-jvm (>=7.0.0-alpha01, <=7.0.0-alpha02)

com.squareup.wire:wire-runtime-jvm MAVEN version =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha02 Source...

Wire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding service

CVE-2026-45799 Maintainer summary Wire's protobuf group-skipping logic did not reject negative lengths before skipping a length-delimited field inside a group. A crafted protobuf payload could cause Wire to throw an unchecked runtime exception during decoding instead of the documented IOException...

androidx.benchmark:benchmark-common (>=1.2.0-alpha14, <=1.2.0-alpha15), androidx.benchmark:benchmark-junit4 (>=1.2.0-alpha14, <=1.2.0-alpha15) +5 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime (4.5.1)

com.squareup.wire:wire-runtime MAVEN version 4.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - androidx.benchmark:benchmark-common =1.2.0-alpha14, =1.2.0-alpha14, =1.2.0-alpha14, =1.2.0-alpha14,...

ch.admin.bit.jeap:jeap-messaging-glue-schema-registry (>=8.15.0, <=8.50.0), com.agorapulse:micronaut-amazon-awssdk-kinesis-worker (>=3.4.3, <=4.0.6) +102 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime-jvm (4.3.0)

com.squareup.wire:wire-runtime-jvm MAVEN version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime-jvm and may be impacted: - ch.admin.bit.jeap:jeap-messaging-glue-schema-registry =8.15.0, =3.4.3, =0.15.8, =1.0.20,...

com.squareup.misk:misk (>=2025.08.08.120309-f9b3da6, <=2025.08.13.204324-d02481c), com.squareup.misk:misk-admin (>=2025.08.08.120309-f9b3da6, <=2025.08.13.204324-d02481c) +27 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime (5.3.8)

com.squareup.wire:wire-runtime MAVEN version 5.3.8 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.misk:misk =2025.08.08.120309-f9b3da6, =2025.08.08.120309-f9b3da6,...

com.eulerstream:tiktok-live-proto (>=0.1.1, <=0.2.0), com.eulerstream:tiktok-live-proto-kotlin (>=0.1.1, <=0.2.0) +34 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime-jvm (5.5.1)

com.squareup.wire:wire-runtime-jvm MAVEN version 5.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime-jvm and may be impacted: - com.eulerstream:tiktok-live-proto =0.1.1, =0.1.1, =0.35.0, =0.35.1 -...

com.squareup.wire:wire-grpc-client (4.5.3), com.squareup.wire:wire-schema (4.5.3) potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime (4.5.3)

com.squareup.wire:wire-runtime MAVEN version 4.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.5.3 - com.squareup.wire:wire-schema 4.5.3 Source cves:...