TI-2026-45064 CVE-2026-63126 · GHSA-9rm7-3qhh-h2mc
Integer overflow in square wire
Priority HIGH 72
Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java.
square
Records4All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9
Exploited now
square records in CISA KEVNo square vulnerabilities are listed in CISA KEV.
Records
4 records
TI-2026-44167 CVE-2026-61695 · GHSA-86wm-r4c5-2rc9
Wire Swift runtime: negative LENGTH_DELIMITED length in skipGroup() crashes any protobuf-decoding service
Priority HIGH 72
Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java.
TI-2026-71027 CVE-2026-109391 · GHSA-f7j3-hchq-qp35
Insecure YAML deserialization in Square Squash symbolication API
Priority MEDIUM 42
Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated attackers to store crafted YAML via the POST /api/1.0/symbolication endpoint.
TI-2024-38317 CVE-2024-58103 · GHSA-pwf9-q62p-v7wc
Uncontrolled recursion in square Wire
Priority LOW 32
Square Wire before 5.2.0 does not enforce a recursion limit on nested groups in ByteArrayProtoReader32.kt and ProtoReader.kt.