{"id":"CVE-2026-45799","summary":"Wire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding service","details":"Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.3.0 and 7.0.0-alpha03, ByteArrayProtoReader32.skipGroup() and ProtoReader.skipGroup() in wire-runtime do not validate that a LENGTH_DELIMITED field length is non-negative before skip(), allowing a crafted protobuf varint encoding -128 as a signed Int to make skip(-128) move the internal position negative and make the next readByte() throw ArrayIndexOutOfBoundsException instead of the documented IOException or ProtocolException, which can crash services using ProtoAdapter.decode(byte[]) on untrusted payloads. This issue is fixed in versions 6.3.0 and 7.0.0-alpha03.","aliases":["GHSA-7xpr-hc2w-34m9"],"modified":"2026-07-25T03:56:13.322986483Z","published":"2026-07-17T19:49:30.331Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45799.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-129"]},"references":[{"type":"WEB","url":"https://github.com/square/wire/releases/tag/6.3.0"},{"type":"WEB","url":"https://github.com/square/wire/releases/tag/7.0.0-alpha03"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45799.json"},{"type":"ADVISORY","url":"https://github.com/square/wire/security/advisories/GHSA-7xpr-hc2w-34m9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45799"},{"type":"FIX","url":"https://github.com/square/wire/commit/47d5b0dba53935d5332cd41a80a353b3fc90e7b0"},{"type":"FIX","url":"https://github.com/square/wire/commit/e4e56fab38a547d9625f05c97f1d8f0bcc3a5773"},{"type":"FIX","url":"https://github.com/square/wire/pull/3595"},{"type":"FIX","url":"https://github.com/square/wire/pull/3597"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/square/wire","events":[{"introduced":"0"},{"introduced":"5df07027c6b180d9a807f5b8afda13760c7a114b"},{"fixed":"86cffeda358c35efdcb9867d2d378eec912a15ec"},{"fixed":"b9aad036a8d8671c025fb3eca79003433789f27a"},{"fixed":"47d5b0dba53935d5332cd41a80a353b3fc90e7b0"},{"fixed":"e4e56fab38a547d9625f05c97f1d8f0bcc3a5773"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"6.3.0"},{"introduced":"7.0.0-alpha01"},{"fixed":"7.0.0-alpha03"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["6.2.0","7.0.0-alpha02","7.0.0-alpha01","6.1.0","6.0.0","6.0.0-alpha03","6.0.0-alpha02","5.4.0","6.0.0-alpha01","5.4.1-alpha.20250925.224059.6ad9f5738","5.3.11","5.3.10","5.3.8","5.3.7","5.3.6","5.4.0-alpha.20250801.192044.864c6c36c","5.3.5","5.3.4","5.3.3","5.3.2","5.4.0-alpha.20250516.195227.10d8b20b2","5.4.0-alpha.20250429.015041.560b597d7","5.4.0-alpha.20250326.102750.35956c85e","5.3.1","5.3.0","5.3.0-alpha.20250212.164711.8dddcef3d.v2","5.3.0-alpha.20250212.164711.8dddcef3d","5.3.0-alpha.20250123.214551.e8d52ce62","5.2.1","5.2.0","5.1.1-alpha.20241206.191847.01e8f3013","5.1.1-alpha.20241127.134142.06e7597bb.v2","5.1.1-alpha.20241017.175147.633cf04b4","5.1.1-alpha.20241016.095539.16b796241","5.1.1-alpha.20241004.194750.5a2084117","5.1.1-alpha.20240920.094122.b98afbb7d.1304","5.1.1-alpha.20240917.084212.96bbc3907","5.1.0","5.0.0","5.0.0-alpha04","5.0.0-alpha03","5.0.0-alpha02","5.0.0-alpha02-square02","5.0.0-alpha02-square01","5.0.0-alpha01","5.0.0-alpha.square.9","5.0.0-alpha.square.8","5.0.0-alpha.square.7","5.0.0-alpha.square.6","4.9.6","4.9.5","4.9.4","4.9.2-square02","4.9.4-square02","4.9.4-square01","4.9.3","4.9.3-square01","4.9.2","4.9.2-square04","4.9.2-square03","4.9.1","4.9.1-square01","4.9.0","4.7.0","4.8.1","4.8.0","4.7.2","4.7.1","4.6.2","4.6.1","4.6.0","4.5.6","4.5.5","4.5.4","4.5.3","4.5.2","4.5.1","4.5.0","4.4.3","4.4.2","4.4.1","4.4.0","4.3.0","4.2.0","4.1.1","4.1.0","4.0.1","4.0.0","4.0.0-alpha.20","4.0.0-alpha.18","4.0.0-alpha.17","4.0.0-alpha.16","3.7.0","parent-4.0.0-alpha.15","4.0.0-alpha.15","parent-4.0.0-alpha.14","parent-4.0.0-alpha13","4.0.0-alpha13","parent-4.0.0-alpha.13","parent-4.0.0-alpha.12","4.0.0-alpha12","4.0.0-alpha.11","4.0.0-alpha.10","4.0.0-alpha.9","4.0.0-alpha.8","4.0.0-alpha.7","4.0.0-alpha.6","4.0.0-alpha.5","4.0.0-alpha.4","4.0.0-alpha.3","4.0.0-alpha1","4.0.0-alpha.2","3.8.0-alpha1","3.6.1","3.6.1-alpha1","3.6.0","3.6.0-alpha1","3.5.1-alpha2","3.5.1-alpha1","3.5.0","3.4.0","3.3.0","3.3.0-alpha2","3.3.0-alpha1","parent-3.2.2","parent-3.2.1","parent-3.2.0","parent-3.1.0","3.0.3","3.0.2","wire-3.0.1","parent-3.0.1","3.0.0","3.0.0-rc03","3.0.0-rc02","parent-3.0.0-rc02","3.0.0-rc01","3.0.0-alpha03","3.0.0-alpha02","3.0.0-alpha01","wire-2.3.0-RC1","wire-2.2.0","wire-2.1.2","wire-2.1.1","wire-2.1.0","wire-2.0.3","wire-2.0.2","wire-2.0.1","wire-2.0.0","wire-2.0.0-BETA10","wire-2.0.0-BETA9","wire-2.0.0-BETA8","wire-2.0.0-BETA7","wire-2.0.0-BETA6","wire-2.0.0-BETA5","wire-2.0.0-BETA4","wire-2.0.0-BETA3","wire-2.0.0-BETA2","wire-2.0.0-BETA1","wire-1.8.0","wire-1.7.0","wire-1.6.1","wire-1.6.0","wire-1.5.2","wire-1.5.1","wire-1.5.0","wire-1.4.0","wire-1.3.3","wire-1.3.2","wire-1.3.1","wire-1.3.0","wire-1.2.0","wire-1.1.1","wire-1.1.0","wire-1.0.1","wire-1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45799.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}