Denial of Service Vulnerability in Wire's gRPC and Protocol Buffers for Mobile Platforms
CVE-2026-63126
7.5HIGH
What is CVE-2026-63126?
The vulnerability in Wire's implementation of protocol buffers and gRPC allows attackers to exploit improper length validation in protobuf readers. Prior to versions 6.4.5 and 7.0.0-alpha04, the decoding methods in Kotlin and related paths can lead to out-of-bounds behavior and excessive resource allocation. By supplying malformed protobuf bytes, an attacker can trigger unchecked exceptions or traps, resulting in a denial of service. This vulnerability does not directly compromise confidentiality or integrity, but it can significantly disrupt services relying on the affected versions.
Affected Version(s)
wire < 6.4.5 < 6.4.5
wire >= 7.0.0-alpha01, < 7.0.0-alpha04 < 7.0.0-alpha01, 7.0.0-alpha04