CVE-2026-45799: Square Wire denial of service in wire-runtime skipGroup

CVE-2026-45799 · Severity: high · CVSS 7.5 · Published 2026-07-17

Square Wire, a library used for handling gRPC and protocol buffers in mobile and Java applications, contains a flaw in how it processes certain data messages. An attacker can send a specially crafted message that causes the application to crash unexpectedly. This can lead to a denial-of-service (DoS) condition, disrupting services that rely on this library to process external data.

Technologies: com.squareup.wire:wire-runtime (Maven). Vendors: Maven.

Quick answers

Is CVE-2026-45799 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-45799 being exploited in the wild.
How severe is CVE-2026-45799?
High severity, with a CVSS score of 7.5, published 17 July 2026.
Which products and versions are affected?
com.squareup.wire:wire-runtime (Maven) ECOSYSTEM:introduced=0,fixed=6.3.0; com.squareup.wire:wire-runtime-jvm (Maven) ECOSYSTEM:introduced=0,fixed=6.3.0.
Is there a fix for CVE-2026-45799?
Yes. com.squareup.wire:wire-runtime (Maven): upgrade to 6.3.0 or later; com.squareup.wire:wire-runtime-jvm (Maven): upgrade to 6.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45799 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-45799?
Check whether you run com.squareup.wire:wire-runtime (Maven), com.squareup.wire:wire-runtime-jvm (Maven), Square Wire Runtime or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • com.squareup.wire:wire-runtime (Maven): upgrade to 6.3.0 or later
    # set com.squareup.wire:wire-runtime to 6.3.0 in your pom.xml or build.gradle
  • com.squareup.wire:wire-runtime-jvm (Maven): upgrade to 6.3.0 or later
    # set com.squareup.wire:wire-runtime-jvm to 6.3.0 in your pom.xml or build.gradle

Technical details

A vulnerability exists in the ByteArrayProtoReader32.skipGroup() and ProtoReader.skipGroup() functions within the wire-runtime component. The root cause is a failure to validate that a LENGTH_DELIMITED field length is non-negative before calling the skip() method. An attacker can provide a crafted protobuf varint encoding -128 as a signed integer, which causes the internal reader position to become negative. Subsequent read operations then trigger an unhandled ArrayIndexOutOfBoundsException instead of the expected IOException or ProtocolException. This results in a service crash when decoding untrusted payloads via ProtoAdapter.decode(byte[]). The issue is resolved in versions 6.3.0 and 7.0.0-alpha03.

Affected products

  • Square wire-runtime < 6.3.0, >= 7.0.0-alpha01, < 7.0.0-alpha03

Identifiers

  • CVE-2026-45799
  • GHSA-7xpr-hc2w-34m9

Timeline

  • 2026-05-12: patched: Fix merged into master branch
  • 2026-05-13: patched: Fix merged into 6.x branch and version 6.3.0 released
  • 2026-05-14: advisory: GitHub Security Advisory published
  • 2026-07-17: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.