CVE-2026-45799 Wire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding service
Attackers can crash Wire-decoding services by sending crafted protobuf payloads that trigger an unhandled exception due to missing negative-length validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-45799?
CVE-2026-45799 is a high-severity denial of service vulnerability in square wire, published on 17 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.3.0 and 7.0.0-alpha03, ByteArrayProtoReader32.skipGroup() and ProtoReader.skipGroup() in wire-runtime do not validate that a LENGTH_DELIMITED field length is non-negative before skip(), allowing a crafted protobuf varint encoding -128 as a signed Int to make skip(-128) move the internal position negative and make the next readByte() throw ArrayIndexOutOfBoundsException instead of the documented IOException or ProtocolException, which can crash services using ProtoAdapter.decode(byte[]) on untrusted payloads. This issue is fixed in versions 6.3.0 and 7.0.0-alpha03.
Weakness: CWE-129
Which versions are affected by CVE-2026-45799?
8 open source packages ship an affected version, including com.squareup.wire:wire-runtime and com.squareup.wire:wire-runtime-jvm. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.squareup.wire:wire-runtime Maven | All versions | 6.3.0 |
com.squareup.wire:wire-runtime Maven | All versions | 6.3.0 |
com.squareup.wire:wire-runtime Maven | From 7.0.0-alpha01 | 7.0.0-alpha03 |
com.squareup.wire:wire-runtime Maven | From 7.0.0-alpha01 | 7.0.0-alpha03 |
com.squareup.wire:wire-runtime-jvm Maven | All versions | 6.3.0 |
com.squareup.wire:wire-runtime-jvm Maven | All versions | 6.3.0 |
2 more packages
com.squareup.wire:wire-runtime-jvm Maven | From 7.0.0-alpha01 | 7.0.0-alpha03 |
com.squareup.wire:wire-runtime-jvm Maven | From 7.0.0-alpha01 | 7.0.0-alpha03 |
Products include Squareup Wire.
How do I fix CVE-2026-45799?
Upgrade com.squareup.wire:wire-runtime to a fixed version for your release line: 6.3.0 or 7.0.0-alpha03.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-45799 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-45799 exists.
Sources
Also known as ECHO-732c-42e9-bce2, GHSA-7xpr-hc2w-34m9, UBUNTU-CVE-2026-45799.