Protocol Parsing Issue in Wire for Various Languages by Square
CVE-2026-45799
7.5HIGH
What is CVE-2026-45799?
A vulnerability in Wire affects its ability to correctly handle LENGTH_DELIMITED fields in the ByteArrayProtoReader32 and ProtoReader classes. Specifically, the methods skipGroup() did not validate that the length of the field was non-negative before executing the skip() operation. This flaw allowed an attacker to exploit crafted protobuf varint encodings, leading to an ArrayIndexOutOfBoundsException when reading untrusted payloads. As a result, this vulnerability can potentially crash services relying on ProtoAdapter.decode(byte[]), requiring immediate attention and the application of relevant updates found in versions 6.3.0 and 7.0.0-alpha03.
Affected Version(s)
wire < 6.3.0 < 6.3.0
wire >= 7.0.0-alpha01, < 7.0.0-alpha03 < 7.0.0-alpha01, 7.0.0-alpha03