Read the docs
TI-2026-33534 Aliases CVE-2026-45799GHSA-7xpr-hc2w-34m9

Wire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding service

Priority HIGH 72CWE-129Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 1 fixed, 3 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-129 and the CVSS impact.

Summary

Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.3.0 and 7.0.0-alpha03, ByteArrayProtoReader32.skipGroup() and ProtoReader.skipGroup() in wire-runtime do not validate that a LENGTH_DELIMITED field length is non-negative before skip(), allowing a crafted protobuf varint encoding -128 as a signed Int to make skip(-128) move the internal position negative and make the next readByte() throw ArrayIndexOutOfBoundsException instead of the documented IOException or ProtocolException, which can crash services using ProtoAdapter.decode(byte[]) on untrusted payloads. This issue is fixed in versions 6.3.0 and 7.0.0-alpha03.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00728 54th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial wire (square): 6.3.0, 7.0.0-alpha03com.squareup.wire:wire-runtime-jvm (Maven): 6.3.0, 7.0.0-alpha03+1 more productRed Hat: 1 advisoryRed Hat: 1 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
squarewirebefore 6.3.0; 7.0.0-alpha01 to before 7.0.0-alpha036.3.0, 7.0.0-alpha03Patch availableCNA
—com.squareup.wire:wire-runtime-jvm (Maven)before 6.3.06.3.0Patch availableGHSA-7xpr-hc2w-34m9
—com.squareup.wire:wire-runtime (Maven)before 6.3.06.3.0Patch availableGHSA-7xpr-hc2w-34m9
—com.squareup.wire:wire-runtime (Maven)7.0.0-alpha01 to before 7.0.0-alpha037.0.0-alpha03Patch availableGHSA-7xpr-hc2w-34m9
—com.squareup.wire:wire-runtime-jvm (Maven)7.0.0-alpha01 to before 7.0.0-alpha037.0.0-alpha03Patch availableGHSA-7xpr-hc2w-34m9
  • wire Vendorsquare Affected before 6.3.0; 7.0.0-alpha01 to before 7.0.0-alpha03 Fixed in 6.3.0, 7.0.0-alpha03 Patch available CNA
  • com.squareup.wire:wire-runtime-jvm (Maven) Vendor— Affected before 6.3.0 Fixed in 6.3.0 Patch available GHSA-7xpr-hc2w-34m9
  • com.squareup.wire:wire-runtime (Maven) Vendor— Affected before 6.3.0 Fixed in 6.3.0 Patch available GHSA-7xpr-hc2w-34m9
  • com.squareup.wire:wire-runtime (Maven) Vendor— Affected 7.0.0-alpha01 to before 7.0.0-alpha03 Fixed in 7.0.0-alpha03 Patch available GHSA-7xpr-hc2w-34m9
  • com.squareup.wire:wire-runtime-jvm (Maven) Vendor— Affected 7.0.0-alpha01 to before 7.0.0-alpha03 Fixed in 7.0.0-alpha03 Patch available GHSA-7xpr-hc2w-34m9

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:squareup:wire:*:*:*:*:*:*:*:*before 6.3.0VulnerableSquareup
cpe:2.3:a:squareup:wire:7.0.0:alpha01:*:*:*:*:*:*7.0.0 alpha01VulnerableSquareup
cpe:2.3:a:squareup:wire:7.0.0:alpha02:*:*:*:*:*:*7.0.0 alpha02VulnerableSquareup
  • cpe:2.3:a:squareup:wire:*:*:*:*:*:*:*:* Versions before 6.3.0 Vulnerable ·Squareup
  • cpe:2.3:a:squareup:wire:7.0.0:alpha01:*:*:*:*:*:* Versions 7.0.0 alpha01 Vulnerable ·Squareup
  • cpe:2.3:a:squareup:wire:7.0.0:alpha02:*:*:*:*:*:* Versions 7.0.0 alpha02 Vulnerable ·Squareup

Remediation

  • Fix · CNA wire (square) Fixed in 6.3.0, 7.0.0-alpha03
  • Fix · GHSA-7xpr-hc2w-34m9 com.squareup.wire:wire-runtime-jvm (Maven) Fixed in 6.3.0 Advisory →
  • Fix · GHSA-7xpr-hc2w-34m9 com.squareup.wire:wire-runtime (Maven) Fixed in 6.3.0 Advisory →
  • Fix · GHSA-7xpr-hc2w-34m9 com.squareup.wire:wire-runtime (Maven) Fixed in 7.0.0-alpha03 Advisory →
  • Fix · GHSA-7xpr-hc2w-34m9 com.squareup.wire:wire-runtime-jvm (Maven) Fixed in 7.0.0-alpha03 Advisory →

Red Hat 1 advisory

  • RHSA-2026:70257 Released 2026-09-22 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.SP2)
    • Red Hat Build of Apache Camel 3.33.3.SP2 com.github.luben.zstd-jni-1.5.7.16-rhel8-redhat-00001.jar, com.squareup.wire.wire-runtime-6.4.7.jar, com.squareup.wire.wire-runtime-jvm-6.4.7.jar +7

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Fuse 7AffectedNo fix planned: Out of support scope
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix yet
Red Hat build of Apicurio Registry 3AffectedNo fix yet
Red Hat Build of Apache Camel 3.33.3.SP2Fixed RHSA-2026:70257
Not affected: 1 product
  • Red Hat Build of Apache Camel 3.33.3.SP2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-45799
  2. 2026-10-03 Alias added: GHSA-7xpr-hc2w-34m9
  3. 2026-10-09 Fix available: RHSA-2026:70257 · Red Hat
  4. 2026-10-10 Fix available: Red Hat Build of Apache Camel 3.33.3.SP2 · Red Hat

References

Exploit 1

Patch 2

Advisory 1

Other 5

  • TI-2026-45064 Integer overflow in square wire CVSS 3.1HIGH 7.5
  • TI-2026-44167 Wire Swift runtime: negative LENGTH_DELIMITED length in skipGroup() crashes any protobuf-decoding service CVSS 3.1HIGH 7.5
  • TI-2026-71027 Insecure YAML deserialization in Square Squash symbolication API CVSS 4.0CRITICAL 9.2
  • TI-2024-38317 Uncontrolled recursion in square Wire CVSS 3.1MEDIUM 5.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences