CVE-2021-29508

Due to how Wire handles type information in its serialization format, malicious payloads can be passed to a deserializer. e.g. using a surrogate on the sender end, an attacker can pass information about a different type for the receiving end. And by doing so allowing the serializer to create any type on the deserializing end. This is the same issue that exists for .NET BinaryFormatter https://docs.microsoft.com/en-us/visualstudio/code-quality/ca2300?view=vs-2019. This also applies to the fork of Wire.

• CWE-502

• https://github.com/AsynkronIT/Wire/security/advisories/GHSA-hpw7-3vq3-mmv6Exploit, Third Party Advisory
• https://www.nuget.org/packages/Wire/Third Party Advisory
• https://github.com/AsynkronIT/Wire/security/advisories/GHSA-hpw7-3vq3-mmv6Exploit, Third Party Advisory
• https://www.nuget.org/packages/Wire/Third Party Advisory

Published

May 11, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-29502WarnSystem is a cog (plugin) for the Red discord bot. A vuln…6.5
• CVE-2021-29503HedgeDoc is a platform to write and share markdown. HedgeDoc…6.1
• CVE-2021-29504WP-CLI is the command-line interface for WordPress. An impro…7.4
• CVE-2021-29505XStream is software for serializing Java objects to XML and …8.8
• CVE-2021-29506GraphHopper is an open-source Java routing engine. In GrassH…6.5
• CVE-2021-29507GENIVI Diagnostic Log and Trace (DLT) provides a log and tra…6.5
• CVE-2021-29509Puma is a concurrent HTTP 1.1 server for Ruby/Rack applicati…7.5
• CVE-2021-29510Pydantic is a data validation and settings management using …7.5
• CVE-2021-29511evm is a pure Rust implementation of Ethereum Virtual Machin…6.5
• CVE-2021-29512TensorFlow is an end-to-end open source platform for machine…7.8
• CVE-2021-29513TensorFlow is an end-to-end open source platform for machine…7.8
• CVE-2021-29514TensorFlow is an end-to-end open source platform for machine…7.8