Vulnerability-Lookup

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-61695 (GCVE-0-2026-61695)

Vulnerability from nvd – Published: 2026-09-23 18:44 – Updated: 2026-09-29 02:07

Title

Wire Swift runtime: negative LENGTH_DELIMITED length in skipGroup() crashes any protobuf-decoding service

Summary

Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.1 and 7.0.0-alpha04, Wire's Swift runtime ProtoReader.skipGroup(expectedEndTag:unknownFieldsWriter:) accepts a negative length for a LENGTH_DELIMITED field inside an unknown START_GROUP field. ProtoReader.readData() forwards the negative count to ReadBuffer.readData(count:), whose upper-bound-only check permits the value to reach Foundation Data(bytes:count:) and trigger an unrecoverable process trap instead of a catchable ProtoDecoder.Error. Any Swift process decoding untrusted protobuf bytes can be crashed without authentication, user interaction, or knowledge of the target schema. This issue is fixed in versions 6.4.1 and 7.0.0-alpha04.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-29 02:07 UTC

CWE

CWE-129 - Improper Validation of Array Index

Assigner

GitHub_M mitre root

References

6 references

URL	Tags
https://github.com/square/wire/security/advisorie…	x_refsource_CONFIRM
https://github.com/square/wire/pull/3616	x_refsource_MISC
https://github.com/square/wire/commit/24043b6b3a5…	x_refsource_MISC
https://github.com/square/wire/commit/81ff7f24a67…	x_refsource_MISC
https://github.com/square/wire/releases/tag/6.4.1	x_refsource_MISC
https://github.com/square/wire/releases/tag/7.0.0…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
square	wire	Affected: < 6.4.1 Affected: >= 7.0.0-alpha01, < 7.0.0-alpha04

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-61695",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-29T02:07:04.183481Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-29T02:07:24.227Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/square/wire/security/advisories/GHSA-86wm-r4c5-2rc9"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "wire",
          "vendor": "square",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.4.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.0.0-alpha01, \u003c 7.0.0-alpha04"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.1 and 7.0.0-alpha04, Wire\u0027s Swift runtime ProtoReader.skipGroup(expectedEndTag:unknownFieldsWriter:) accepts a negative length for a LENGTH_DELIMITED field inside an unknown START_GROUP field. ProtoReader.readData() forwards the negative count to ReadBuffer.readData(count:), whose upper-bound-only check permits the value to reach Foundation Data(bytes:count:) and trigger an unrecoverable process trap instead of a catchable ProtoDecoder.Error. Any Swift process decoding untrusted protobuf bytes can be crashed without authentication, user interaction, or knowledge of the target schema. This issue is fixed in versions 6.4.1 and 7.0.0-alpha04."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-129",
              "description": "CWE-129: Improper Validation of Array Index",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T18:44:11.336Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/square/wire/security/advisories/GHSA-86wm-r4c5-2rc9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/square/wire/security/advisories/GHSA-86wm-r4c5-2rc9"
        },
        {
          "name": "https://github.com/square/wire/pull/3616",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/square/wire/pull/3616"
        },
        {
          "name": "https://github.com/square/wire/commit/24043b6b3a5e5974a978f2745b76d50b31407c1c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/square/wire/commit/24043b6b3a5e5974a978f2745b76d50b31407c1c"
        },
        {
          "name": "https://github.com/square/wire/commit/81ff7f24a6795d9a8be2e03f272b2d979a5d2c7e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/square/wire/commit/81ff7f24a6795d9a8be2e03f272b2d979a5d2c7e"
        },
        {
          "name": "https://github.com/square/wire/releases/tag/6.4.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/square/wire/releases/tag/6.4.1"
        },
        {
          "name": "https://github.com/square/wire/releases/tag/7.0.0-alpha04",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/square/wire/releases/tag/7.0.0-alpha04"
        }
      ],
      "source": {
        "advisory": "GHSA-86wm-r4c5-2rc9",
        "discovery": "UNKNOWN"
      },
      "title": "Wire Swift runtime: negative LENGTH_DELIMITED length in skipGroup() crashes any protobuf-decoding service"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-61695",
    "datePublished": "2026-09-23T18:44:11.336Z",
    "dateReserved": "2026-07-10T18:36:58.850Z",
    "dateUpdated": "2026-09-29T02:07:24.227Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63126 (GCVE-0-2026-63126)

Vulnerability from nvd – Published: 2026-09-16 18:13 – Updated: 2026-09-16 19:41

Title

Wire: Unauthenticated decoder crash via 32-bit length integer overflow in ByteArrayProtoReader32 (incomplete fix of CVE-2026-45799)

Summary

Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.5 and 7.0.0-alpha04, Wire protobuf readers do not consistently validate attacker-controlled lengths against the current logical message boundary before advancing cursors, pointers, limits, slices, or allocations. In Kotlin, ProtoAdapter.decode(ByteArray) and ProtoAdapter.decode(ByteString) use ByteArrayProtoReader32.internalNextLengthDelimited(), where a positive oversized length can wrap pos + length to a negative limit and escape the existing negative-length check. Related ProtoReader, ReadBuffer.readVarint(), ReadBuffer.verifyAdditional(count:), packed-repeated, nested-message, and ProtoDecoder.decodeSizeDelimited(_:from:) paths can cross logical boundaries, perform pointer arithmetic, reserve capacity, or convert an unrepresentable size before proving the requested bytes exist. An attacker who supplies malformed protobuf bytes can cause unchecked exceptions, traps, out-of-bounds behavior, or excessive allocation, resulting in denial of service without known confidentiality, integrity, or code-execution impact. This issue is fixed in versions 6.4.5 and 7.0.0-alpha04.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-16 19:41 UTC

CWE

CWE-190 - Integer Overflow or Wraparound

Assigner

GitHub_M mitre root

References

6 references

URL	Tags
https://github.com/square/wire/security/advisorie…	x_refsource_CONFIRM
https://github.com/square/wire/pull/3635	x_refsource_MISC
https://github.com/square/wire/commit/082d5d83cec…	x_refsource_MISC
https://github.com/square/wire/commit/25ebcabb9ab…	x_refsource_MISC
https://github.com/square/wire/releases/tag/6.4.5	x_refsource_MISC
https://github.com/square/wire/releases/tag/7.0.0…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
square	wire	Affected: < 6.4.5 Affected: >= 7.0.0-alpha01, < 7.0.0-alpha04

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63126",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T19:41:27.470490Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T19:41:42.146Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/square/wire/security/advisories/GHSA-9rm7-3qhh-h2mc"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "wire",
          "vendor": "square",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.4.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.0.0-alpha01, \u003c 7.0.0-alpha04"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.5 and 7.0.0-alpha04, Wire protobuf readers do not consistently validate attacker-controlled lengths against the current logical message boundary before advancing cursors, pointers, limits, slices, or allocations. In Kotlin, ProtoAdapter.decode(ByteArray) and ProtoAdapter.decode(ByteString) use ByteArrayProtoReader32.internalNextLengthDelimited(), where a positive oversized length can wrap pos + length to a negative limit and escape the existing negative-length check. Related ProtoReader, ReadBuffer.readVarint(), ReadBuffer.verifyAdditional(count:), packed-repeated, nested-message, and ProtoDecoder.decodeSizeDelimited(_:from:) paths can cross logical boundaries, perform pointer arithmetic, reserve capacity, or convert an unrepresentable size before proving the requested bytes exist. An attacker who supplies malformed protobuf bytes can cause unchecked exceptions, traps, out-of-bounds behavior, or excessive allocation, resulting in denial of service without known confidentiality, integrity, or code-execution impact. This issue is fixed in versions 6.4.5 and 7.0.0-alpha04."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190: Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T18:13:33.197Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/square/wire/security/advisories/GHSA-9rm7-3qhh-h2mc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/square/wire/security/advisories/GHSA-9rm7-3qhh-h2mc"
        },
        {
          "name": "https://github.com/square/wire/pull/3635",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/square/wire/pull/3635"
        },
        {
          "name": "https://github.com/square/wire/commit/082d5d83cec57ef68f1dd7d3e3d1d641c1fb670f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/square/wire/commit/082d5d83cec57ef68f1dd7d3e3d1d641c1fb670f"
        },
        {
          "name": "https://github.com/square/wire/commit/25ebcabb9ab7f12d1d77af75ecbc51726fddc015",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/square/wire/commit/25ebcabb9ab7f12d1d77af75ecbc51726fddc015"
        },
        {
          "name": "https://github.com/square/wire/releases/tag/6.4.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/square/wire/releases/tag/6.4.5"
        },
        {
          "name": "https://github.com/square/wire/releases/tag/7.0.0-alpha04",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/square/wire/releases/tag/7.0.0-alpha04"
        }
      ],
      "source": {
        "advisory": "GHSA-9rm7-3qhh-h2mc",
        "discovery": "UNKNOWN"
      },
      "title": "Wire: Unauthenticated decoder crash via 32-bit length integer overflow in ByteArrayProtoReader32 (incomplete fix of CVE-2026-45799)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63126",
    "datePublished": "2026-09-16T18:13:33.197Z",
    "dateReserved": "2026-07-15T16:54:55.816Z",
    "dateUpdated": "2026-09-16T19:41:42.146Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-45799 (GCVE-0-2026-45799)

Vulnerability from nvd – Published: 2026-07-17 19:49 – Updated: 2026-07-20 13:51

Title

Wire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding service

Summary

Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.3.0 and 7.0.0-alpha03, ByteArrayProtoReader32.skipGroup() and ProtoReader.skipGroup() in wire-runtime do not validate that a LENGTH_DELIMITED field length is non-negative before skip(), allowing a crafted protobuf varint encoding -128 as a signed Int to make skip(-128) move the internal position negative and make the next readByte() throw ArrayIndexOutOfBoundsException instead of the documented IOException or ProtocolException, which can crash services using ProtoAdapter.decode(byte[]) on untrusted payloads. This issue is fixed in versions 6.3.0 and 7.0.0-alpha03.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-20 13:51 UTC

CWE

CWE-129 - Improper Validation of Array Index

Assigner

GitHub_M mitre root

References

7 references

URL	Tags
https://github.com/square/wire/security/advisorie…	x_refsource_CONFIRM
https://github.com/square/wire/pull/3595	x_refsource_MISC
https://github.com/square/wire/pull/3597	x_refsource_MISC
https://github.com/square/wire/commit/47d5b0dba53…	x_refsource_MISC
https://github.com/square/wire/commit/e4e56fab38a…	x_refsource_MISC
https://github.com/square/wire/releases/tag/6.3.0	x_refsource_MISC
https://github.com/square/wire/releases/tag/7.0.0…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
square	wire	Affected: < 6.3.0 Affected: >= 7.0.0-alpha01, < 7.0.0-alpha03

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-45799",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-20T13:51:12.411548Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-20T13:51:25.748Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/square/wire/security/advisories/GHSA-7xpr-hc2w-34m9"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "wire",
          "vendor": "square",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.3.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.0.0-alpha01, \u003c 7.0.0-alpha03"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.3.0 and 7.0.0-alpha03, ByteArrayProtoReader32.skipGroup() and ProtoReader.skipGroup() in wire-runtime do not validate that a LENGTH_DELIMITED field length is non-negative before skip(), allowing a crafted protobuf varint encoding -128 as a signed Int to make skip(-128) move the internal position negative and make the next readByte() throw ArrayIndexOutOfBoundsException instead of the documented IOException or ProtocolException, which can crash services using ProtoAdapter.decode(byte[]) on untrusted payloads. This issue is fixed in versions 6.3.0 and 7.0.0-alpha03."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-129",
              "description": "CWE-129: Improper Validation of Array Index",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-17T19:49:30.331Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/square/wire/security/advisories/GHSA-7xpr-hc2w-34m9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/square/wire/security/advisories/GHSA-7xpr-hc2w-34m9"
        },
        {
          "name": "https://github.com/square/wire/pull/3595",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/square/wire/pull/3595"
        },
        {
          "name": "https://github.com/square/wire/pull/3597",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/square/wire/pull/3597"
        },
        {
          "name": "https://github.com/square/wire/commit/47d5b0dba53935d5332cd41a80a353b3fc90e7b0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/square/wire/commit/47d5b0dba53935d5332cd41a80a353b3fc90e7b0"
        },
        {
          "name": "https://github.com/square/wire/commit/e4e56fab38a547d9625f05c97f1d8f0bcc3a5773",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/square/wire/commit/e4e56fab38a547d9625f05c97f1d8f0bcc3a5773"
        },
        {
          "name": "https://github.com/square/wire/releases/tag/6.3.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/square/wire/releases/tag/6.3.0"
        },
        {
          "name": "https://github.com/square/wire/releases/tag/7.0.0-alpha03",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/square/wire/releases/tag/7.0.0-alpha03"
        }
      ],
      "source": {
        "advisory": "GHSA-7xpr-hc2w-34m9",
        "discovery": "UNKNOWN"
      },
      "title": "Wire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding service"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-45799",
    "datePublished": "2026-07-17T19:49:30.331Z",
    "dateReserved": "2026-05-13T08:19:32.603Z",
    "dateUpdated": "2026-07-20T13:51:25.748Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-58103 (GCVE-0-2024-58103)

Vulnerability from nvd – Published: 2025-03-16 00:00 – Updated: 2025-03-17 15:50

Summary

Square Wire before 5.2.0 does not enforce a recursion limit on nested groups in ByteArrayProtoReader32.kt and ProtoReader.kt.

Severity

5.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-03-17 15:50 UTC

CWE

CWE-674 - Uncontrolled Recursion

Assigner

mitre mitre root

References

2 references

URL	Tags
https://github.com/square/wire/commit/b90e60c09be…
https://github.com/square/wire/compare/5.1.0...5.2.0

Impacted products

1 product

Vendor	Product	Version
Square	Wire	Affected: 0 , < 5.2.0 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-58103",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-17T15:50:16.370764Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-17T15:50:25.364Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Wire",
          "vendor": "Square",
          "versions": [
            {
              "lessThan": "5.2.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Square Wire before 5.2.0 does not enforce a recursion limit on nested groups in ByteArrayProtoReader32.kt and ProtoReader.kt."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674 Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-16T03:49:13.239Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/square/wire/commit/b90e60c09befaff836a2fc2ee4d678451b2ec75d"
        },
        {
          "url": "https://github.com/square/wire/compare/5.1.0...5.2.0"
        }
      ],
      "x_generator": {
        "engine": "enrichogram 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2024-58103",
    "datePublished": "2025-03-16T00:00:00.000Z",
    "dateReserved": "2025-03-16T00:00:00.000Z",
    "dateUpdated": "2025-03-17T15:50:25.364Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2026-61695 (GCVE-0-2026-61695)

Vulnerability from cvelistv5 – Published: 2026-09-23 18:44 – Updated: 2026-09-29 02:07

Title

Wire Swift runtime: negative LENGTH_DELIMITED length in skipGroup() crashes any protobuf-decoding service

Summary

Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.1 and 7.0.0-alpha04, Wire's Swift runtime ProtoReader.skipGroup(expectedEndTag:unknownFieldsWriter:) accepts a negative length for a LENGTH_DELIMITED field inside an unknown START_GROUP field. ProtoReader.readData() forwards the negative count to ReadBuffer.readData(count:), whose upper-bound-only check permits the value to reach Foundation Data(bytes:count:) and trigger an unrecoverable process trap instead of a catchable ProtoDecoder.Error. Any Swift process decoding untrusted protobuf bytes can be crashed without authentication, user interaction, or knowledge of the target schema. This issue is fixed in versions 6.4.1 and 7.0.0-alpha04.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-29 02:07 UTC

CWE

CWE-129 - Improper Validation of Array Index

Assigner

GitHub_M mitre root

References

6 references

URL	Tags
https://github.com/square/wire/security/advisorie…	x_refsource_CONFIRM
https://github.com/square/wire/pull/3616	x_refsource_MISC
https://github.com/square/wire/commit/24043b6b3a5…	x_refsource_MISC
https://github.com/square/wire/commit/81ff7f24a67…	x_refsource_MISC
https://github.com/square/wire/releases/tag/6.4.1	x_refsource_MISC
https://github.com/square/wire/releases/tag/7.0.0…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
square	wire	Affected: < 6.4.1 Affected: >= 7.0.0-alpha01, < 7.0.0-alpha04

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-61695",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-29T02:07:04.183481Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-29T02:07:24.227Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/square/wire/security/advisories/GHSA-86wm-r4c5-2rc9"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "wire",
          "vendor": "square",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.4.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.0.0-alpha01, \u003c 7.0.0-alpha04"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.1 and 7.0.0-alpha04, Wire\u0027s Swift runtime ProtoReader.skipGroup(expectedEndTag:unknownFieldsWriter:) accepts a negative length for a LENGTH_DELIMITED field inside an unknown START_GROUP field. ProtoReader.readData() forwards the negative count to ReadBuffer.readData(count:), whose upper-bound-only check permits the value to reach Foundation Data(bytes:count:) and trigger an unrecoverable process trap instead of a catchable ProtoDecoder.Error. Any Swift process decoding untrusted protobuf bytes can be crashed without authentication, user interaction, or knowledge of the target schema. This issue is fixed in versions 6.4.1 and 7.0.0-alpha04."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-129",
              "description": "CWE-129: Improper Validation of Array Index",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T18:44:11.336Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/square/wire/security/advisories/GHSA-86wm-r4c5-2rc9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/square/wire/security/advisories/GHSA-86wm-r4c5-2rc9"
        },
        {
          "name": "https://github.com/square/wire/pull/3616",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/square/wire/pull/3616"
        },
        {
          "name": "https://github.com/square/wire/commit/24043b6b3a5e5974a978f2745b76d50b31407c1c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/square/wire/commit/24043b6b3a5e5974a978f2745b76d50b31407c1c"
        },
        {
          "name": "https://github.com/square/wire/commit/81ff7f24a6795d9a8be2e03f272b2d979a5d2c7e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/square/wire/commit/81ff7f24a6795d9a8be2e03f272b2d979a5d2c7e"
        },
        {
          "name": "https://github.com/square/wire/releases/tag/6.4.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/square/wire/releases/tag/6.4.1"
        },
        {
          "name": "https://github.com/square/wire/releases/tag/7.0.0-alpha04",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/square/wire/releases/tag/7.0.0-alpha04"
        }
      ],
      "source": {
        "advisory": "GHSA-86wm-r4c5-2rc9",
        "discovery": "UNKNOWN"
      },
      "title": "Wire Swift runtime: negative LENGTH_DELIMITED length in skipGroup() crashes any protobuf-decoding service"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-61695",
    "datePublished": "2026-09-23T18:44:11.336Z",
    "dateReserved": "2026-07-10T18:36:58.850Z",
    "dateUpdated": "2026-09-29T02:07:24.227Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63126 (GCVE-0-2026-63126)

Vulnerability from cvelistv5 – Published: 2026-09-16 18:13 – Updated: 2026-09-16 19:41

Title

Wire: Unauthenticated decoder crash via 32-bit length integer overflow in ByteArrayProtoReader32 (incomplete fix of CVE-2026-45799)

Summary

Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.5 and 7.0.0-alpha04, Wire protobuf readers do not consistently validate attacker-controlled lengths against the current logical message boundary before advancing cursors, pointers, limits, slices, or allocations. In Kotlin, ProtoAdapter.decode(ByteArray) and ProtoAdapter.decode(ByteString) use ByteArrayProtoReader32.internalNextLengthDelimited(), where a positive oversized length can wrap pos + length to a negative limit and escape the existing negative-length check. Related ProtoReader, ReadBuffer.readVarint(), ReadBuffer.verifyAdditional(count:), packed-repeated, nested-message, and ProtoDecoder.decodeSizeDelimited(_:from:) paths can cross logical boundaries, perform pointer arithmetic, reserve capacity, or convert an unrepresentable size before proving the requested bytes exist. An attacker who supplies malformed protobuf bytes can cause unchecked exceptions, traps, out-of-bounds behavior, or excessive allocation, resulting in denial of service without known confidentiality, integrity, or code-execution impact. This issue is fixed in versions 6.4.5 and 7.0.0-alpha04.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-16 19:41 UTC

CWE

CWE-190 - Integer Overflow or Wraparound

Assigner

GitHub_M mitre root

References

6 references

URL	Tags
https://github.com/square/wire/security/advisorie…	x_refsource_CONFIRM
https://github.com/square/wire/pull/3635	x_refsource_MISC
https://github.com/square/wire/commit/082d5d83cec…	x_refsource_MISC
https://github.com/square/wire/commit/25ebcabb9ab…	x_refsource_MISC
https://github.com/square/wire/releases/tag/6.4.5	x_refsource_MISC
https://github.com/square/wire/releases/tag/7.0.0…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
square	wire	Affected: < 6.4.5 Affected: >= 7.0.0-alpha01, < 7.0.0-alpha04

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63126",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T19:41:27.470490Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T19:41:42.146Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/square/wire/security/advisories/GHSA-9rm7-3qhh-h2mc"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "wire",
          "vendor": "square",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.4.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.0.0-alpha01, \u003c 7.0.0-alpha04"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.5 and 7.0.0-alpha04, Wire protobuf readers do not consistently validate attacker-controlled lengths against the current logical message boundary before advancing cursors, pointers, limits, slices, or allocations. In Kotlin, ProtoAdapter.decode(ByteArray) and ProtoAdapter.decode(ByteString) use ByteArrayProtoReader32.internalNextLengthDelimited(), where a positive oversized length can wrap pos + length to a negative limit and escape the existing negative-length check. Related ProtoReader, ReadBuffer.readVarint(), ReadBuffer.verifyAdditional(count:), packed-repeated, nested-message, and ProtoDecoder.decodeSizeDelimited(_:from:) paths can cross logical boundaries, perform pointer arithmetic, reserve capacity, or convert an unrepresentable size before proving the requested bytes exist. An attacker who supplies malformed protobuf bytes can cause unchecked exceptions, traps, out-of-bounds behavior, or excessive allocation, resulting in denial of service without known confidentiality, integrity, or code-execution impact. This issue is fixed in versions 6.4.5 and 7.0.0-alpha04."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190: Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T18:13:33.197Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/square/wire/security/advisories/GHSA-9rm7-3qhh-h2mc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/square/wire/security/advisories/GHSA-9rm7-3qhh-h2mc"
        },
        {
          "name": "https://github.com/square/wire/pull/3635",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/square/wire/pull/3635"
        },
        {
          "name": "https://github.com/square/wire/commit/082d5d83cec57ef68f1dd7d3e3d1d641c1fb670f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/square/wire/commit/082d5d83cec57ef68f1dd7d3e3d1d641c1fb670f"
        },
        {
          "name": "https://github.com/square/wire/commit/25ebcabb9ab7f12d1d77af75ecbc51726fddc015",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/square/wire/commit/25ebcabb9ab7f12d1d77af75ecbc51726fddc015"
        },
        {
          "name": "https://github.com/square/wire/releases/tag/6.4.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/square/wire/releases/tag/6.4.5"
        },
        {
          "name": "https://github.com/square/wire/releases/tag/7.0.0-alpha04",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/square/wire/releases/tag/7.0.0-alpha04"
        }
      ],
      "source": {
        "advisory": "GHSA-9rm7-3qhh-h2mc",
        "discovery": "UNKNOWN"
      },
      "title": "Wire: Unauthenticated decoder crash via 32-bit length integer overflow in ByteArrayProtoReader32 (incomplete fix of CVE-2026-45799)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63126",
    "datePublished": "2026-09-16T18:13:33.197Z",
    "dateReserved": "2026-07-15T16:54:55.816Z",
    "dateUpdated": "2026-09-16T19:41:42.146Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-45799 (GCVE-0-2026-45799)

Vulnerability from cvelistv5 – Published: 2026-07-17 19:49 – Updated: 2026-07-20 13:51

Title

Wire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding service

Summary

Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.3.0 and 7.0.0-alpha03, ByteArrayProtoReader32.skipGroup() and ProtoReader.skipGroup() in wire-runtime do not validate that a LENGTH_DELIMITED field length is non-negative before skip(), allowing a crafted protobuf varint encoding -128 as a signed Int to make skip(-128) move the internal position negative and make the next readByte() throw ArrayIndexOutOfBoundsException instead of the documented IOException or ProtocolException, which can crash services using ProtoAdapter.decode(byte[]) on untrusted payloads. This issue is fixed in versions 6.3.0 and 7.0.0-alpha03.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-20 13:51 UTC

CWE

CWE-129 - Improper Validation of Array Index

Assigner

GitHub_M mitre root

References

7 references

URL	Tags
https://github.com/square/wire/security/advisorie…	x_refsource_CONFIRM
https://github.com/square/wire/pull/3595	x_refsource_MISC
https://github.com/square/wire/pull/3597	x_refsource_MISC
https://github.com/square/wire/commit/47d5b0dba53…	x_refsource_MISC
https://github.com/square/wire/commit/e4e56fab38a…	x_refsource_MISC
https://github.com/square/wire/releases/tag/6.3.0	x_refsource_MISC
https://github.com/square/wire/releases/tag/7.0.0…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
square	wire	Affected: < 6.3.0 Affected: >= 7.0.0-alpha01, < 7.0.0-alpha03

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-45799",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-20T13:51:12.411548Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-20T13:51:25.748Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/square/wire/security/advisories/GHSA-7xpr-hc2w-34m9"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "wire",
          "vendor": "square",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.3.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.0.0-alpha01, \u003c 7.0.0-alpha03"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.3.0 and 7.0.0-alpha03, ByteArrayProtoReader32.skipGroup() and ProtoReader.skipGroup() in wire-runtime do not validate that a LENGTH_DELIMITED field length is non-negative before skip(), allowing a crafted protobuf varint encoding -128 as a signed Int to make skip(-128) move the internal position negative and make the next readByte() throw ArrayIndexOutOfBoundsException instead of the documented IOException or ProtocolException, which can crash services using ProtoAdapter.decode(byte[]) on untrusted payloads. This issue is fixed in versions 6.3.0 and 7.0.0-alpha03."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-129",
              "description": "CWE-129: Improper Validation of Array Index",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-17T19:49:30.331Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/square/wire/security/advisories/GHSA-7xpr-hc2w-34m9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/square/wire/security/advisories/GHSA-7xpr-hc2w-34m9"
        },
        {
          "name": "https://github.com/square/wire/pull/3595",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/square/wire/pull/3595"
        },
        {
          "name": "https://github.com/square/wire/pull/3597",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/square/wire/pull/3597"
        },
        {
          "name": "https://github.com/square/wire/commit/47d5b0dba53935d5332cd41a80a353b3fc90e7b0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/square/wire/commit/47d5b0dba53935d5332cd41a80a353b3fc90e7b0"
        },
        {
          "name": "https://github.com/square/wire/commit/e4e56fab38a547d9625f05c97f1d8f0bcc3a5773",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/square/wire/commit/e4e56fab38a547d9625f05c97f1d8f0bcc3a5773"
        },
        {
          "name": "https://github.com/square/wire/releases/tag/6.3.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/square/wire/releases/tag/6.3.0"
        },
        {
          "name": "https://github.com/square/wire/releases/tag/7.0.0-alpha03",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/square/wire/releases/tag/7.0.0-alpha03"
        }
      ],
      "source": {
        "advisory": "GHSA-7xpr-hc2w-34m9",
        "discovery": "UNKNOWN"
      },
      "title": "Wire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding service"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-45799",
    "datePublished": "2026-07-17T19:49:30.331Z",
    "dateReserved": "2026-05-13T08:19:32.603Z",
    "dateUpdated": "2026-07-20T13:51:25.748Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-58103 (GCVE-0-2024-58103)

Vulnerability from cvelistv5 – Published: 2025-03-16 00:00 – Updated: 2025-03-17 15:50

Summary

Square Wire before 5.2.0 does not enforce a recursion limit on nested groups in ByteArrayProtoReader32.kt and ProtoReader.kt.

Severity

5.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-03-17 15:50 UTC

CWE

CWE-674 - Uncontrolled Recursion

Assigner

mitre mitre root

References

2 references

URL	Tags
https://github.com/square/wire/commit/b90e60c09be…
https://github.com/square/wire/compare/5.1.0...5.2.0

Impacted products

1 product

Vendor	Product	Version
Square	Wire	Affected: 0 , < 5.2.0 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-58103",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-17T15:50:16.370764Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-17T15:50:25.364Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Wire",
          "vendor": "Square",
          "versions": [
            {
              "lessThan": "5.2.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Square Wire before 5.2.0 does not enforce a recursion limit on nested groups in ByteArrayProtoReader32.kt and ProtoReader.kt."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674 Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-16T03:49:13.239Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/square/wire/commit/b90e60c09befaff836a2fc2ee4d678451b2ec75d"
        },
        {
          "url": "https://github.com/square/wire/compare/5.1.0...5.2.0"
        }
      ],
      "x_generator": {
        "engine": "enrichogram 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2024-58103",
    "datePublished": "2025-03-16T00:00:00.000Z",
    "dateReserved": "2025-03-16T00:00:00.000Z",
    "dateUpdated": "2025-03-17T15:50:25.364Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

8 vulnerabilities found for Wire by Square

CVE-2026-61695 (GCVE-0-2026-61695)

CVE-2026-63126 (GCVE-0-2026-63126)

CVE-2026-45799 (GCVE-0-2026-45799)

CVE-2024-58103 (GCVE-0-2024-58103)

CVE-2026-61695 (GCVE-0-2026-61695)

CVE-2026-63126 (GCVE-0-2026-63126)

CVE-2026-45799 (GCVE-0-2026-45799)

CVE-2024-58103 (GCVE-0-2024-58103)

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

8 vulnerabilities found for Wire by Square

CVE-2026-61695 (GCVE-0-2026-61695)

CVE-2026-63126 (GCVE-0-2026-63126)

CVE-2026-45799 (GCVE-0-2026-45799)

CVE-2024-58103 (GCVE-0-2024-58103)

CVE-2026-61695 (GCVE-0-2026-61695)

CVE-2026-63126 (GCVE-0-2026-63126)

CVE-2026-45799 (GCVE-0-2026-45799)

CVE-2024-58103 (GCVE-0-2024-58103)

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.