CVE-2026-45799

Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.3.0 and 7.0.0-alpha03, ByteArrayProtoReader32.skipGroup() and ProtoReader.skipGroup() in wire-runtime do not validate that a LENGTH_DELIMITED field length is non-negative before skip(), allowing a crafted protobuf varint encoding -128 as a signed Int to make skip(-128) move the internal position negative and make the next readByte() throw ArrayIndexOutOfBoundsException instead of the documented IOException or ProtocolException, which can crash services using ProtoAdapter.decode(byte[]) on untrusted payloads. This issue is fixed in versions 6.3.0 and 7.0.0-alpha03.

• CWE-129

• https://github.com/square/wire/commit/47d5b0dba53935d5332cd41a80a353b3fc90e7b0Patch
• https://github.com/square/wire/commit/e4e56fab38a547d9625f05c97f1d8f0bcc3a5773Patch
• https://github.com/square/wire/pull/3595Issue Tracking
• https://github.com/square/wire/pull/3597Issue Tracking
• https://github.com/square/wire/releases/tag/6.3.0Release Notes
• https://github.com/square/wire/releases/tag/7.0.0-alpha03Release Notes
• https://github.com/square/wire/security/advisories/GHSA-7xpr-hc2w-34m9Vendor Advisory, Exploit
• https://github.com/square/wire/security/advisories/GHSA-7xpr-hc2w-34m9Vendor Advisory, Exploit

Published

Jul 17, 2026

Last Modified

Aug 12, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4579A vulnerability was identified in code-projects Simple Laund…9.8
• CVE-2026-45792rtk filters and compresses command outputs before they reach…5.5
• CVE-2026-45793Composer is a dependency Manager for the PHP language. Prior…7.5
• CVE-2026-45795The Janssen Project is an open-source identity and access ma…5.3
• CVE-2026-45796Coder allows organizations to provision remote development e…6.5
• CVE-2026-45797HeyForm is an open-source form builder. Prior to version 3.0…6.4
• CVE-2026-4580A security flaw has been discovered in code-projects Simple …9.8
• CVE-2026-45800Vvveb is a powerful and easy to use CMS with page builder to…8.7
• CVE-2026-45802FPDI is a collection of PHP classes that facilitate reading …6
• CVE-2026-45803`gh` is GitHub’s official command line tool. From 1.6.0 to b…3.5
• CVE-2026-45804Diffusers is the a library for pretrained diffusion models. …7.5
• CVE-2026-45805Penpot is an open-source design tool for design and code col…8.8